ming - Multiple Vulnerabilities
Summary
DLA-1386-1: ming - security update. Affects ming versions < 1:0.4.4-1.1+deb7u9. Fixed in 1:0.4.4-1.1+deb7u9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ming is a package in the Debian ecosystem, specifically in Debian 7 Wheezy. It is a library for generating SWF (Flash) format movies. Ming allows developers to create dynamic and interactive content for web applications. However, multiple vulnerabilities have been discovered in Ming, which could potentially be exploited by remote attackers to cause a denial of service.
Vulnerability Detail
The vulnerabilities in Ming include:
-
CVE-2018-7866: A NULL pointer dereference in the newVar3 function (util/decompile.c) could be leveraged by remote attackers to cause a denial of service via a crafted swf file.
-
CVE-2018-7873: A heap-based buffer overflow vulnerability in the getString function (util/decompile.c) could be exploited by remote attackers to cause a denial of service via a crafted swf file.
-
CVE-2018-7876: An integer overflow and resulting memory exhaustion in the parseSWF_ACTIONRECORD function (util/parser.c) could be leveraged by remote attackers to cause a denial of service via a crafted swf file.
-
CVE-2018-9009: Various heap-based buffer overflow vulnerabilities in util/decompiler.c could be exploited by remote attackers to cause a denial of service via a crafted swf file.
-
CVE-2018-9132: A NULL pointer dereference in the getInt function (util/decompile.c) could be leveraged by remote attackers to cause a denial of service via a crafted swf file.
How To Fix
Minimum fixed version
1:0.4.4-1.1+deb7u9
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mingTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no mentioned workarounds for these vulnerabilities.
Conclusion
Multiple vulnerabilities have been discovered in the ming package, which could be exploited by remote attackers to cause a denial of service. It is crucial to upgrade to the fixed version (1:0.4.4-1.1+deb7u9 or later) to ensure the security of the system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ming →
FAQ
Ming is a library for generating SWF (Flash) format movies, allowing developers to create dynamic and interactive content for web applications.
These vulnerabilities could be exploited by remote attackers to cause a denial of service, potentially leading to system instability or unavailability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by these vulnerabilities. Simply upload your manifest file (e.g., package-lock.json) and it will provide real-time monitoring and alerts for open-source vulnerabilities.
No, there are no known workarounds for these vulnerabilities. It is recommended to upgrade to the fixed version of the ming package.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for ming.
