CVE-2018-9165 Null dereference in n/a

Medium 6.5 Published 1 Apr 2018 Updated 5 Aug 2024

Attackers can cause a denial of service via a crafted SWF file due to a NULL pointer dereference in the libming library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2018-9165?

CVE-2018-9165 is a medium-severity vulnerability in Libming Libming, published on 1 Apr 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The pushdup function in util/decompile.c in libming through 0.4.8 does not recognize the need for ActionPushDuplicate to perform a deep copy when a String is at the top of the stack, making the library vulnerable to a util/decompile.c getName NULL pointer dereference, which may allow attackers to cause a denial of service via a crafted SWF file.

Weakness: CWE-476

Which versions are affected by CVE-2018-9165?

It affects 1 product.

Products include Libming Libming.

How do I fix CVE-2018-9165?

Upgrade to a fixed version.

Is CVE-2018-9165 being exploited?

There is no known exploitation of CVE-2018-9165 in the wild and no public exploit code.

All Libming Libming vulnerabilities

Sources

Also known as GHSA-ffg8-fgfp-q9p2, UBUNTU-CVE-2018-9165.