swftools vulnerabilities and fixes

Recent CVEs affecting swftools, with upgrade or downgrade steps. 19 tracked.

swftools has 19 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2024-04-11. Highest priority: CVE-2024-26339 (score 56/100).

• CVE-2024-28458 HIGH 7.5 DOWNGRADE Null Pointer Dereference vulnerability in swfdump in swftools 0.9.2 allows attackers to crash the appliation v
• CVE-2024-26339 CRITICAL 9.1 DOWNGRADE swftools v0.9.2 was discovered to contain a strcpy parameter overlap via /home/swftools/src/swfc+0x48318a.
• CVE-2024-26337 MEDIUM 4.3 DOWNGRADE swftools v0.9.2 was discovered to contain a segmentation violation via the function s_font at swftools/src/swf
• CVE-2024-26335 MEDIUM 5.5 DOWNGRADE swftools v0.9.2 was discovered to contain a segmentation violation via the function state_free at swftools/src
• CVE-2024-26334 MEDIUM 6.2 DOWNGRADE swftools v0.9.2 was discovered to contain a segmentation violation via the function compileSWFActionCode at sw
• CVE-2024-26333 MEDIUM 5.5 DOWNGRADE swftools v0.9.2 was discovered to contain a segmentation violation via the function free_lines at swftools/lib
• CVE-2024-25165 HIGH 7.8 DOWNGRADE A global-buffer-overflow vulnerability was found in SWFTools v0.9.2, in the function LineText at lib/swf5compi
• CVE-2024-22957 MEDIUM 5.5 DOWNGRADE swftools 0.9.2 was discovered to contain an Out-of-bounds Read vulnerability via the function dict_do_lookup i
• CVE-2024-22956 HIGH 7.8 DOWNGRADE swftools 0.9.2 was discovered to contain a heap-use-after-free vulnerability via the function removeFromTo at
• CVE-2024-22955 HIGH 7.8 DOWNGRADE swftools 0.9.2 was discovered to contain a stack-buffer-underflow vulnerability via the function parseExpressi
• CVE-2024-22920 HIGH 7.8 DOWNGRADE swftools 0.9.2 was discovered to contain a heap-use-after-free via the function bufferWriteData in swftools/li
• CVE-2024-22919 HIGH 7.8 DOWNGRADE swftools0.9.2 was discovered to contain a global-buffer-overflow vulnerability via the function parseExpressio
• CVE-2024-22915 HIGH 7.8 DOWNGRADE A heap-use-after-free was found in SWFTools v0.9.2, in the function swf_DeleteTag at rfxswf.c:1193
• CVE-2024-22914 MEDIUM 5.5 DOWNGRADE A heap-use-after-free was found in SWFTools v0.9.2, in the function input at lex.swf5.c:2620
• CVE-2024-22913 HIGH 7.8 DOWNGRADE A heap-buffer-overflow was found in SWFTools v0.9.2, in the function swf5lex at lex.swf5.c:1321
• CVE-2024-22912 HIGH 7.8 DOWNGRADE A global-buffer-overflow was found in SWFTools v0.9.2, in the function countline at swf5compiler.flex:327
• CVE-2024-22911 HIGH 7.8 DOWNGRADE A stack-buffer-underflow vulnerability was found in SWFTools v0.9.2, in the function parseExpression at src/sw
• CVE-2024-22562 HIGH 7.8 DOWNGRADE swftools 0.9.2 was discovered to contain a Stack Buffer Underflow via the function dict_foreach_keyvalue at sw
• CVE-2023-37644 MEDIUM 5.5 DOWNGRADE SWFTools 0.9.2 772e55a allows attackers to trigger a large memory-allocation attempt via a crafted document, a

FAQ

How do I fix swftools vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is swftools being exploited right now?

None of the tracked swftools CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which swftools CVE should I patch first?

CVE-2024-26339 currently ranks highest (56/100): swftools v0.9.2 was discovered to contain a strcpy parameter overlap via /home/swftools/src/swfc+0x48318a..

RSS feed for swftools · ← Back to latest CVEs