Bug 22281 - swftools new security issue CVE-2017-7698
Summary: swftools new security issue CVE-2017-7698
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA5TOO MGA5-32-OK MGA6-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2017-12-29 06:01 CET by David Walser
Modified: 2018-01-03 16:51 CET (History)
3 users (show)

See Also:
Source RPM: swftools-0.9.2-7.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2017-12-29 06:01:33 CET
Upstream committed a pull request to fix a security issue on May 8:
https://github.com/matthiaskramm/swftools/commit/c7747f4b10739bd365c3e79d153b99fbfac9a4ac

Patched packages uploaded for Mageia 5, Mageia 6, and Cauldron.

Advisory:
========================

Updated swftools package fix security vulnerability:

A Use After Free in the pdf2swf part of swftools 0.9.2 and earlier allows
remote attackers to execute arbitrary code via a malformed PDF document,
due to bundled code in Gfx.cc from Xpdf 3.02 (CVE-2017-7698).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7698
https://github.com/matthiaskramm/swftools/commit/c7747f4b10739bd365c3e79d153b99fbfac9a4ac
========================

Updated packages in core/updates_testing:
========================
swftools-0.9.2-7.2.mga5
swftools-0.9.2-9.1.mga6

from SRPMS:
swftools-0.9.2-7.2.mga5.src.rpm
swftools-0.9.2-9.1.mga6.src.rpm
David Walser 2017-12-29 06:01:43 CET

Whiteboard: (none) => MGA5TOO

Comment 1 Herman Viaene 2017-12-30 10:57:43 CET
MGA5-32 on Dell Latitude D600
No installation issues
Ref to bug 20846 Comment 4
Used at CLI
$ jpeg2swf /home/tester5/Afbeeldingen/*.jpg
and
$ gnash output.swf 
runs the images OK
OK for me

CC: (none) => herman.viaene
Whiteboard: MGA5TOO => MGA5TOO MGA5-32-OK

Dave Hodgins 2018-01-01 08:30:21 CET

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 2 Dave Hodgins 2018-01-03 15:01:35 CET
Ok on M6 x86_64.

Validating the update.

Whiteboard: MGA5TOO MGA5-32-OK => MGA5TOO MGA5-32-OK MGA6-64-OK
Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 3 Mageia Robot 2018-01-03 16:51:49 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2018-0052.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.