Created attachment 723320 [details]
CVE-2017-8400_PoC_and_analysis

Ref: https://nvd.nist.gov/vuln/detail/CVE-2017-8400
====================================================
Description

In SWFTools 0.9.2, an out-of-bounds write of heap data can occur in the
function png_load() in lib/png.c:755. This issue can be triggered by a
malformed PNG file that is mishandled by png2swf. Attackers could exploit this
issue for DoS; it might cause arbitrary code execution.

Source:  MITRE      Last Modified:  05/01/2017
===================================================

Hyperlink

[1] https://github.com/matthiaskramm/swftools/issues/13

[2]
https://github.com/matthiaskramm/swftools/commit/7139f3cf7c8bc576bea1dbd07c58ce1ad92b774a


(open-)SUSE: https://software.opensuse.org/package/swftools

0.9.2 (TW, 42.{1,2}, official repo)

Bug ID	1037050
Summary	VUL-0: CVE-2017-8400: swftools: out-of-bound write of heap data issue can occur in function png_load()(lib/png.c:755)
Classification	openSUSE
Product	openSUSE Distribution
Version	Leap 42.2
Hardware	Other
OS	Other
Status	NEW
Severity	Normal
Priority	P5 - None
Component	Security
Assignee	security-team@suse.de
Reporter	mikhail.kasimov@gmail.com
QA Contact	qa-bugs@suse.de
Found By	---
Blocker	---