Security Update for ming Package
Summary
DLA-1176-1: ming - security update. Affects ming versions < 1:0.4.4-1.1+deb7u5. Fixed in 1:0.4.4-1.1+deb7u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ming package is a library for generating Macromedia Flash files (.swf). It provides a set of APIs for creating Flash animations, games, and interactive applications. The package is widely used by developers to incorporate Flash content into their projects.
Vulnerability Detail
Multiple vulnerabilities have been discovered in the ming package. These vulnerabilities include:
-
CVE-2017-9988: A NULL pointer dereference in the readEncUInt30 function (util/read.c) allows attackers to cause a denial of service by exploiting a crafted file.
-
CVE-2017-9989: A NULL pointer dereference in the outputABC_STRING_INFO function (util/outputtxt.c) allows attackers to cause a denial of service by exploiting a crafted file.
-
CVE-2017-11733: A NULL pointer dereference in the stackswap function (util/decompile.c) allows attackers to cause a denial of service by exploiting a crafted file.
These vulnerabilities can be exploited by malicious actors to crash applications utilizing the ming library, potentially leading to a disruption of service.
How To Fix
Minimum fixed version
1:0.4.4-1.1+deb7u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mingTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The ming package has been found to have multiple vulnerabilities that can be exploited to cause a denial of service. To mitigate these vulnerabilities, it is recommended to upgrade the ming package to version 1:0.4.4-1.1+deb7u5 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ming →
FAQ
The ming package is a library for generating Macromedia Flash files (.swf). It provides APIs for creating Flash animations, games, and interactive applications.
The vulnerabilities in the ming package include CVE-2017-9988, CVE-2017-9989, and CVE-2017-11733. These vulnerabilities allow attackers to cause a denial of service by exploiting crafted files.
A NULL pointer dereference occurs when a program attempts to access or manipulate memory using a pointer that is not pointing to a valid memory location (i.e., it has a value of NULL). This can lead to crashes or other unexpected behavior.
A denial of service attack is an attempt to make a computer system or network unavailable to its intended users by overwhelming it with a flood of illegitimate requests or by exploiting vulnerabilities to crash the system.
To upgrade the ming package, you can use the package manager command 'sudo apt-get update' followed by 'sudo apt-get install ming'. This will fetch and install the latest version of the package.
Related vulnerabilities
Recent vulnerabilities recorded for ming.
