PT-2010-3191 · Swftools · Swftools

Publicado 2010-08-17 · Atualizado 2018-10-10 · CVE-2010-1516

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SWFTools version 0.9.1

Description The issue is related to multiple integer overflows that can be triggered by remote attackers through crafted image files, specifically PNG and JPEG files. This is associated with the getPNG function in lib/png.c and the jpeg load function in lib/jpeg.c.

Recommendations For SWFTools version 0.9.1, consider avoiding the use of the getPNG function in lib/png.c and the jpeg load function in lib/jpeg.c until a patch is available. Restrict the processing of PNG and JPEG files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2010-1516

Produtos afetados

Swftools

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2010-1516 · Nota de Segurança
• http://secunia.com/secunia_research/2010-80 · Aviso do Fabricante
• http://securityfocus.com/archive/1/513102/100/0/threaded · Nota
• http://secunia.com/advisories/39970 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-201204-05.xml · Aviso do Fabricante
• http://secunia.com/advisories/48821 · Nota