CVE-2017-8400

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In SWFTools 0.9.2, an out-of-bounds write of heap data can occur in the function png_load() in lib/png.c:755. This issue can be triggered by a malformed PNG file that is mishandled by png2swf. Attackers could exploit this issue for DoS; it might cause arbitrary code execution.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: May 1, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-84016.5In SWFTools 0.9.2, an out-of-bounds read of heap data can occur in the function png_load() in lib/png.c:724. This issue can be triggered by CVE-2017-84028.8PivotX 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .htaccess file.CVE-2017-84038.8360fly 4K cameras allow unauthenticated Wi-Fi password changes and complete access with REST by using the Bluetooth Low Energy pairing proce CVE-2017-84049.8An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video cli CVE-2017-84057.5An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connect CVE-2017-84068.8An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the we CVE-2017-84078.8An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password f CVE-2017-84089.8An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video cli CVE-2017-84097.5An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password CVE-2017-84109.8An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connect CVE-2017-84118.8An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video cli CVE-2017-84128.8An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom binary called mp4ts under the /var/www/video folder