The swf_DefineLosslessBitsTagToImage function in lib/modules/swfbits.c in SWFTools 0.9.2 mishandles an uncompress failure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) because of extractDefinitions in lib/readers/swf.c and fill_line_bitmap in lib/devices/render.c, as demonstrated by swfrender.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Swftools | Swftools | 0.9.2 (including) | 0.9.2 (including) |
| Swftools | Ubuntu | artful | * |
| Swftools | Ubuntu | bionic | * |
| Swftools | Ubuntu | cosmic | * |
| Swftools | Ubuntu | disco | * |
| Swftools | Ubuntu | esm-apps/bionic | * |
| Swftools | Ubuntu | esm-apps/xenial | * |
| Swftools | Ubuntu | trusty | * |
| Swftools | Ubuntu | upstream | * |
| Swftools | Ubuntu | xenial | * |
| Swftools | Ubuntu | zesty | * |