Integer overflow in the GnashImage::size method in libbase/GnashImage.h in GNU Gnash 0.8.10 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SWF file, which triggers a heap-based buffer overflow.

specially crafted swf files could cause an integer overflow in gnash

The remote host is affected by the vulnerability described in GLSA-201207-08 (Gnash: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in Gnash:
      The 'nsPluginInstance::setupCookies()' function in plugin.cpp creates         world-readable cookies with predictable file names (CVE-2011-4328).
      The 'GnashImage::size()' function in GnashImage.h contains an integer         overflow error which could cause a heap-based buffer overflow         (CVE-2012-1175).
  Impact :

    A remote attacker could entice a user to open a specially crafted SWF       file, possibly resulting in execution of arbitrary code or a Denial of       Service condition. Furthermore, a local attacker may be able to obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

Fix CVE-2012-1175

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been identified in Gnash, the GNU Flash player.

  - CVE-2012-1175     Tielei Wang from Georgia Tech Information Security     Center discovered a vulnerability in GNU Gnash which is     caused due to an integer overflow error and can be     exploited to cause a heap-based buffer overflow by     tricking a user into opening a specially crafted SWF     file.

  - CVE-2011-4328     Alexander Kurtz discovered an unsafe management of HTTP     cookies. Cookie files are stored under /tmp and have     predictable names, and the vulnerability allows a local     attacker to overwrite arbitrary files the users has     write permissions for, and are also world-readable which     may cause information leak.

  - CVE-2010-4337     Jakub Wilk discovered an unsafe management of temporary     files during the build process. Files are stored under     /tmp and have predictable names, and the vulnerability     allows a local attacker to overwrite arbitrary files the     users has write permissions for.

ID	Name	Product	Family	Severity
74576	openSUSE Security Update : gnash (openSUSE-SU-2012:0415-1)	Nessus	SuSE Local Security Checks	medium
59900	GLSA-201207-08 : Gnash: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
58489	Fedora 16 : gnash-0.8.10-2.fc16 (2012-4032)	Nessus	Fedora Local Security Checks	medium
58468	Fedora 15 : gnash-0.8.10-2.fc15 (2012-4070)	Nessus	Fedora Local Security Checks	medium
58419	Fedora 17 : gnash-0.8.10-2.fc17 (2012-3837)	Nessus	Fedora Local Security Checks	medium
58392	Debian DSA-2435-1 : gnash - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-1175

high

Tenable Plugins

medium

medium

medium

medium

medium

medium