CVE-2017-8420 Denial of service in n/a
Attackers can cause a denial of service in SWFTools by providing a malformed TTF file to the font2swf utility.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2017-8420?
CVE-2017-8420 is a medium-severity denial of service vulnerability in Swftools Swftools, published on 5 Jul 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SWFTools 2013-04-09-1007 on Windows has a "Data from Faulting Address controls Branch Selection starting at image00000000_00400000+0x0000000000003e71" issue. This issue can be triggered by a malformed TTF file that is mishandled by font2swf. Attackers could exploit this issue for DoS (Access Violation).
Weakness: CWE-119
Which versions are affected by CVE-2017-8420?
It affects 1 product.
Products include Swftools Swftools.
How do I fix CVE-2017-8420?
No fix has been published for CVE-2017-8420 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-8420 being exploited?
There is no known exploitation of CVE-2017-8420 in the wild and no public exploit code.
Other vulnerabilities in Swftools Swftools
Sources
Also known as GHSA-38mm-4j73-pxpp, UBUNTU-CVE-2017-8420.