Debian Security Advisory
DLA-890-1 ming -- LTS security update
- Date Reported:
- 10 Apr 2017
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2017-7578.
- More information:
It was discovered that there were multiple heap-based buffer overflows in ming, a library to generate SWF (Flash) files.
The updated packages prevent a crash in the
listswfutility due to a heap-based buffer overflow in the parseSWF_RGBA function and several other functions in parser.c.
AddressSanitizer flagged them as invalid writes
of size 1but the heap could be written to multiple times. The overflows are caused by a pointer behind the bounds of a statically allocated array of structs of type SWF_GRADIENTRECORD.
For Debian 7
Wheezy, this issue has been fixed in ming version 1:0.4.4-1.1+deb7u2.
We recommend that you upgrade your ming packages.