Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
126 results · page 3 of 3
Nov 16, 2017In SWFTools, a stack overflow was found in pdf2swf.CVE-2017-1000186 · Other software · Swftools · reported by MITREMedium 5.5
In SWFTools, a stack overflow was found in pdf2swf.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2017In SWFTools, a memcpy buffer overflow was found in gif2swf.CVE-2017-1000185 · Other software · Swftools · reported by MITREMedium 5.5
In SWFTools, a memcpy buffer overflow was found in gif2swf.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2017In SWFTools, a memory leak was found in wav2swf.CVE-2017-1000182 · Other software · Swftools · reported by MITREMedium 5.5
In SWFTools, a memory leak was found in wav2swf.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2017In SWFTools, a memcpy buffer overflow was found in swfc.CVE-2017-1000176 · Other software · Swftools · reported by MITREMedium 5.5
In SWFTools, a memcpy buffer overflow was found in swfc.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2017In SWFTools, an address access exception was found in swfdump swf_GetBits().CVE-2017-1000174 · Other software · Swftools · reported by MITREMedium 5.5
In SWFTools, an address access exception was found in swfdump swf_GetBits().
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2017In SWFTools 0.9.2, the png_load function in lib/png.c does not properly validate an alloclen_64 multiplication of width and height values, which allows remote aCVE-2017-16797 · Other software · Swftools · reported by MITREHigh 7.8
In SWFTools 0.9.2, the png_load function in lib/png.c does not properly validate an alloclen_64 multiplication of width and height values, which allows remote attackers to cause a denial of service (integer overflow, heap-based buffer overflow, and application crash) or possibly have unspecified other impact via a crafted PNG file.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2017In SWFTools 0.9.2, the png_load function in lib/png.c does not check the return value of a realloc call, which allows remote attackers to cause a denial of servCVE-2017-16796 · Other software · Swftools · reported by MITREHigh 7.8
In SWFTools 0.9.2, the png_load function in lib/png.c does not check the return value of a realloc call, which allows remote attackers to cause a denial of service (invalid write and application crash) or possibly have unspecified other impact via vectors involving an IDAT tag in a crafted PNG file.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2017The png_load function in lib/png.c in SWFTools 0.9.2 does not properly validate a multiplication of width and bits-per-pixel values, which allows remote attackeCVE-2017-16794 · Other software · Swftools · reported by MITREMedium 5.5
The png_load function in lib/png.c in SWFTools 0.9.2 does not properly validate a multiplication of width and bits-per-pixel values, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an erroneous png_load call that occurs because of incorrect integer data types in png2swf.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2017The wav_convert2mono function in lib/wav.c in SWFTools 0.9.2 does not properly validate WAV data, which allows remote attackers to cause a denial of service (inCVE-2017-16793 · Other software · Swftools · reported by MITREHigh 7.8
The wav_convert2mono function in lib/wav.c in SWFTools 0.9.2 does not properly validate WAV data, which allows remote attackers to cause a denial of service (incorrect malloc and heap-based buffer overflow) or possibly have unspecified other impact via a crafted file.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2017The swf_DefineLosslessBitsTagToImage function in lib/modules/swfbits.c in SWFTools 0.9.2 mishandles an uncompress failure, which allows remote attackers to causCVE-2017-16711 · Other software · Swftools · reported by MITREMedium 5.5
The swf_DefineLosslessBitsTagToImage function in lib/modules/swfbits.c in SWFTools 0.9.2 mishandles an uncompress failure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) because of extractDefinitions in lib/readers/swf.c and fill_line_bitmap in lib/devices/render.c, as demonstrated by swfrender.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jul 7, 2017When SWFTools 0.9.2 processes a crafted file in swfcombine, it can lead to a NULL Pointer Dereference in the swf_Relocate() function in lib/modules/swftools.c.CVE-2017-11101 · Other software · Swftools · reported by MITREHigh 8.8
When SWFTools 0.9.2 processes a crafted file in swfcombine, it can lead to a NULL Pointer Dereference in the swf_Relocate() function in lib/modules/swftools.c.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2017When SWFTools 0.9.2 processes a crafted file in swfextract, it can lead to a NULL Pointer Dereference in the swf_FoldSprite() function in lib/rxfswf.c.CVE-2017-11100 · Other software · Swftools · reported by MITREHigh 8.8
When SWFTools 0.9.2 processes a crafted file in swfextract, it can lead to a NULL Pointer Dereference in the swf_FoldSprite() function in lib/rxfswf.c.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2017When SWFTools 0.9.2 processes a crafted file in wav2swf, it can lead to a Segmentation Violation in the wav_convert2mono() function in lib/wav.c.CVE-2017-11099 · Other software · Swftools · reported by MITREHigh 8.8
When SWFTools 0.9.2 processes a crafted file in wav2swf, it can lead to a Segmentation Violation in the wav_convert2mono() function in lib/wav.c.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2017When SWFTools 0.9.2 processes a crafted file in png2swf, it can lead to a Segmentation Violation in the png_load() function in lib/png.c.CVE-2017-11098 · Other software · Swftools · reported by MITREHigh 8.8
When SWFTools 0.9.2 processes a crafted file in png2swf, it can lead to a Segmentation Violation in the png_load() function in lib/png.c.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2017When SWFTools 0.9.2 processes a crafted file in swfc, it can lead to a NULL Pointer Dereference in the dict_lookup() function in lib/q.c.CVE-2017-11097 · Other software · Swftools · reported by MITREHigh 8.8
When SWFTools 0.9.2 processes a crafted file in swfc, it can lead to a NULL Pointer Dereference in the dict_lookup() function in lib/q.c.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2017When SWFTools 0.9.2 processes a crafted file in swfcombine, it can lead to a NULL Pointer Dereference in the swf_DeleteFilter() function in lib/modules/swffilteCVE-2017-11096 · Other software · Swftools · reported by MITREHigh 8.8
When SWFTools 0.9.2 processes a crafted file in swfcombine, it can lead to a NULL Pointer Dereference in the swf_DeleteFilter() function in lib/modules/swffilter.c.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2017When SWFTools 0.9.2 processes a crafted file in ttftool, it can lead to a heap-based buffer over-read in the readBlock() function in lib/ttf.c.CVE-2017-10976 · Other software · Swftools · reported by MITREHigh 7.5
When SWFTools 0.9.2 processes a crafted file in ttftool, it can lead to a heap-based buffer over-read in the readBlock() function in lib/ttf.c.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2017In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted filCVE-2017-9927 · Other software · Swftools · reported by MITREHigh 8.8
In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted file, related to a "Read Access Violation starting at image00000000_00400000+0x000000000001b5fe."
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2017In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted filCVE-2017-9926 · Other software · Swftools · reported by MITREHigh 8.8
In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted file, related to a "Read Access Violation starting at image00000000_00400000+0x000000000001b596."
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2017In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to execute arbitrary code or cause a denial of service via a crafted file, related to a CVE-2017-9925 · Other software · Swftools · reported by MITREHigh 8.8
In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to execute arbitrary code or cause a denial of service via a crafted file, related to a "User Mode Write AV near NULL starting at wow64!Wow64NotifyDebugger+0x000000000000001d."
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2017In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to execute arbitrary code or cause a denial of service via a crafted file, related to a CVE-2017-9924 · Other software · Swftools · reported by MITREHigh 8.8
In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to execute arbitrary code or cause a denial of service via a crafted file, related to a "User Mode Write AV starting at image00000000_00400000+0x000000000001b72a."
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2017SWFTools 2013-04-09-1007 on Windows has a "Data from Faulting Address controls Branch Selection starting at image00000000_00400000+0x0000000000003e71" issue.CVE-2017-8420 · Other software · Swftools · reported by MITREMedium 6.5
SWFTools 2013-04-09-1007 on Windows has a "Data from Faulting Address controls Branch Selection starting at image00000000_00400000+0x0000000000003e71" issue. This issue can be triggered by a malformed TTF file that is mishandled by font2swf. Attackers could exploit this issue for DoS (Access Violation).
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2017A Use After Free in the pdf2swf part of swftools 0.9.2 and earlier allows remote attackers to execute arbitrary code via a malformed PDF document, possibly a coCVE-2017-7698 · Other software · Swftools · reported by MITREHigh 7.8
A Use After Free in the pdf2swf part of swftools 0.9.2 and earlier allows remote attackers to execute arbitrary code via a malformed PDF document, possibly a consequence of an error in Gfx.cc in Xpdf 3.02.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2017In SWFTools 0.9.2, an out-of-bounds read of heap data can occur in the function png_load() in lib/png.c:724.CVE-2017-8401 · Other software · Swftools · reported by MITREMedium 6.5
In SWFTools 0.9.2, an out-of-bounds read of heap data can occur in the function png_load() in lib/png.c:724. This issue can be triggered by a malformed PNG file that is mishandled by png2swf. Attackers could exploit this issue for DoS.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2017In SWFTools 0.9.2, an out-of-bounds write of heap data can occur in the function png_load() in lib/png.c:755.CVE-2017-8400 · Other software · Swftools · reported by MITREHigh 8.8
In SWFTools 0.9.2, an out-of-bounds write of heap data can occur in the function png_load() in lib/png.c:755. This issue can be triggered by a malformed PNG file that is mishandled by png2swf. Attackers could exploit this issue for DoS; it might cause arbitrary code execution.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2010Multiple integer overflows in SWFTools 0.9.1 allow remote attackers to execute arbitrary code via (1) a crafted PNG file, related to the getPNG function in lib/CVE-2010-1516 · Other software · Swftools · reported by PSIRT-CNA@flexerasoftware.comHigh 9.3
Multiple integer overflows in SWFTools 0.9.1 allow remote attackers to execute arbitrary code via (1) a crafted PNG file, related to the getPNG function in lib/png.c; or (2) a crafted JPEG file, related to the jpeg_load function in lib/jpeg.c.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.