SB2017053124 - Multiple vulnerabilities in libming

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017053124

SB2017053124 - Multiple vulnerabilities in libming

Published: May 31, 2017 Updated: August 8, 2020

Security Bulletin ID SB2017053124
Severity
High
Patch available
NO
Number of vulnerabilities 21
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 21 secuirty vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2019-16705)

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

Ming (aka libming) 0.4.8 has an out of bounds read vulnerability in the function OpCode() in the decompile.c file in libutil.a.


2) Integer overflow (CVE-ID: CVE-2019-12980)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In Ming (aka libming) 0.4.8, there is an integer overflow (caused by an out-of-range left shift) in the SWFInput_readSBits function in blocks/input.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted swf file.


3) Buffer overflow (CVE-ID: CVE-2019-12981)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Ming (aka libming) 0.4.8 has an "fill overflow" vulnerability in the function SWFShape_setLeftFillStyle in blocks/shape.c.


4) Buffer overflow (CVE-ID: CVE-2019-12982)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Ming (aka libming) 0.4.8 has a heap buffer overflow and underflow in the decompileCAST function in util/decompile.c in libutil.a. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted SWF file.


5) Out-of-bounds read (CVE-ID: CVE-2019-3572)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer over-read in the function writePNG in the file util/dbl2png.c of the dbl2png command-line program. Because this is associated with an erroneous call to png_write_row in libpng, an out-of-bounds write might occur for some memory layouts. A remote attacker can perform a denial of service attack.


6) Out-of-bounds read (CVE-ID: CVE-2018-20591)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A heap-based buffer over-read was discovered in decompileJUMP function in util/decompile.c of libming v0.4.8. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by swftocxx.


7) NULL pointer dereference (CVE-ID: CVE-2018-20425)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the pushdup function of the decompile.c file. A remote attacker can perform a denial of service (DoS) attack.


8) NULL pointer dereference (CVE-ID: CVE-2018-20426)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the newVar3 function of the decompile.c file, a different vulnerability than CVE-2018-7866. A remote attacker can perform a denial of service (DoS) attack.


9) NULL pointer dereference (CVE-ID: CVE-2018-20427)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the getInt function of the decompile.c file, a different vulnerability than CVE-2018-9132. A remote attacker can perform a denial of service (DoS) attack.


10) NULL pointer dereference (CVE-ID: CVE-2018-20428)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the strlenext function of the decompile.c file, a different vulnerability than CVE-2018-7874. A remote attacker can perform a denial of service (DoS) attack.


11) NULL pointer dereference (CVE-ID: CVE-2018-20429)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the getName function of the decompile.c file, a different vulnerability than CVE-2018-7872 and CVE-2018-9165. A remote attacker can perform a denial of service (DoS) attack.


12) NULL pointer dereference (CVE-ID: CVE-2018-13250)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a crafted swf file.


13) Resource exhaustion (CVE-ID: CVE-2018-13251)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In libming 0.4.8, there is an excessive memory allocation attempt in the readBytes function of the util/read.c file, related to parseSWF_DEFINEBITSJPEG2. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted swf file.


14) Memory leak (CVE-ID: CVE-2018-13066)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within util/parser.c in libming 0.4.8, which will lead to a denial of service via parseSWF_DEFINEBUTTON2, parseSWF_DEFINEFONT, parseSWF_DEFINEFONTINFO, parseSWF_DEFINELOSSLESS, parseSWF_DEFINESPRITE, parseSWF_DEFINETEXT, parseSWF_DOACTION, parseSWF_FILLSTYLEARRAY, parseSWF_FRAMELABEL, parseSWF_LINESTYLEARRAY, parseSWF_PLACEOBJECT2, or parseSWF_SHAPEWITHSTYLE. A remote attacker can perform a denial of service attack.


15) Use-after-free (CVE-ID: CVE-2018-8961)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In libming 0.4.8, the decompilePUSHPARAM function of decompile.c has a use-after-free. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file.


16) Use-after-free (CVE-ID: CVE-2018-8962)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In libming 0.4.8, the decompileSingleArgBuiltInFunctionCall function of decompile.c has a use-after-free. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file.


17) Use-after-free (CVE-ID: CVE-2018-8963)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In libming 0.4.8, the decompileGETVARIABLE function of decompile.c has a use-after-free. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file.


18) Use-after-free (CVE-ID: CVE-2018-8964)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In libming 0.4.8, the decompileDELETE function of decompile.c has a use-after-free. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file.


19) Use-after-free (CVE-ID: CVE-2018-8806)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In libming 0.4.8, there is a use-after-free in the decompileArithmeticOp function of decompile.c. Remote attackers could use this vulnerability to cause a denial-of-service via a crafted swf file.


20) Use-after-free (CVE-ID: CVE-2018-8807)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In libming 0.4.8, these is a use-after-free in the function decompileCALLFUNCTION of decompile.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file.


21) Input validation error (CVE-ID: CVE-2017-8782)

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service via a large file that is mishandled by listswf, listaction, etc.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References