{"id":"CVE-2017-9988","aliases":["DLA-1176-1","EUVD-2017-18897","GHSA-wm6x-77v8-ppg5","MGASA-2018-0212","UBUNTU-CVE-2017-9988"],"status":"published","title":"The readEncUInt30 function in util/read.c in libming 0.4.8 mishandles memory allocation. A...","description":"The readEncUInt30 function in util/read.c in libming 0.4.8 mishandles memory allocation. A crafted input will lead to a remote denial of service (NULL pointer dereference) attack against parser.c.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0203,"percentile":0.81173,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-476"],"published":"2017-06-28T06:00:00Z","modified":"2026-10-20T10:49:36Z","affected":[{"source":"osv","ecosystem":"Debian:7","package":"ming","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.4.4-1.1+deb7u5"}]}],"versions":["1:0.4.4-1.1","1:0.4.4-1.1+deb7u1","1:0.4.4-1.1+deb7u2","1:0.4.4-1.1+deb7u3","1:0.4.4-1.1+deb7u4"],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"ming","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5-14.1.mga6"}]}],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ming","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.4.5-1.2ubuntu2","1:0.4.5-1.2ubuntu5","1:0.4.5-1.2ubuntu6","1:0.4.5-1.2ubuntu7"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"libming","product":"libming"}],"references":[{"url":"https://github.com/libming/libming/issues/85","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00022.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201904-24","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9988"},{"url":"https://github.com/advisories/GHSA-wm6x-77v8-ppg5"},{"url":"https://advisories.mageia.org/MGASA-2018-0212.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9988","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9988","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-9988","description":"The readEncUInt30 function in util/read.c in libming 0.4.8 mishandles memory allocation. A crafted input will lead to a remote denial of service (NULL pointer dereference) attack against parser.c.","status":"published","published":"2017-06-28T06:00:00Z","modified":"2024-08-05T17:25:00.724Z","updated_at":"2026-11-02T14:33:13.606903Z"}],"euvd":[{"id":"EUVD-2017-18897","description":"The readEncUInt30 function in util/read.c in libming 0.4.8 mishandles memory allocation. A crafted input will lead to a remote denial of service (NULL pointer dereference) attack against parser.c.","status":"published","published":"2017-06-28T06:00:00Z","modified":"2024-08-05T17:25:00Z","updated_at":"2026-11-03T02:23:26.143318Z"}],"ghsa":[{"id":"GHSA-wm6x-77v8-ppg5","title":"The readEncUInt30 function in util/read.c in libming 0.4.8 mishandles memory allocation. A...","description":"The readEncUInt30 function in util/read.c in libming 0.4.8 mishandles memory allocation. A crafted input will lead to a remote denial of service (NULL pointer dereference) attack against parser.c.","status":"published","published":"2022-05-14T01:06:50Z","modified":"2023-02-02T05:03:05Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:51:33.931227Z"}],"nvd":[{"id":"CVE-2017-9988","description":"The readEncUInt30 function in util/read.c in libming 0.4.8 mishandles memory allocation. A crafted input will lead to a remote denial of service (NULL pointer dereference) attack against parser.c.","status":"published","published":"2017-06-28T06:29:00.363Z","modified":"2026-06-17T01:29:19.89Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:03:51.893212Z"}],"osv":[{"id":"CVE-2017-9988","description":"The readEncUInt30 function in util/read.c in libming 0.4.8 mishandles memory allocation. A crafted input will lead to a remote denial of service (NULL pointer dereference) attack against parser.c.","status":"published","published":"2017-06-28T06:29:00.363Z","modified":"2026-10-20T10:49:36.505682923Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"UBUNTU-CVE-2017-9988","description":"The readEncUInt30 function in util/read.c in libming 0.4.8 mishandles memory allocation. A crafted input will lead to a remote denial of service (NULL pointer dereference) attack against parser.c.","status":"published","published":"2017-06-28T06:29:00Z","modified":"2026-04-22T11:38:29.293199Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DLA-1176-1","title":"ming - security update","status":"published","published":"2017-11-18T00:00:00Z","modified":"2026-03-09T01:01:46.000341Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"MGASA-2018-0212","title":"Updated ming packages fix security vulnerabilities","description":"The readString function in util/read.c and util/old/read.c in libming\n0.4.8 allows remote attackers to cause a denial of service via a large\nfile that is mishandled by listswf, listaction, etc. This occurs\nbecause of an integer overflow that leads to a memory allocation error.\n(CVE-2017-8782)\n\nThe readEncUInt30 function in util/read.c in libming 0.4.8 mishandles\nmemory allocation. A crafted input will lead to a remote denial of\nservice (NULL pointer dereference) attack against parser.c.\n(CVE-2017-9988)\n\nutil/outputtxt.c in libming 0.4.8 mishandles memory allocation. A\ncrafted input will lead to a remote denial of service (NULL pointer\ndereference) attack. (CVE-2017-9989)\n\nA heap-based buffer over-read was found in the function decompileIF in\nutil/decompile.c in Ming 0.4.8, which allows attackers to cause a denial\nof service via a crafted file. (CVE-2017-11704)\n\nA heap-based buffer over-read was found in the function OpCode (called\nfrom decompileSETMEMBER) in util/decompile.c in Ming 0.4.8, which allows\nattackers to cause a denial of service via a crafted file.\n(CVE-2017-11728)\n\nA heap-based buffer over-read was found in the function OpCode (called\nfrom decompileINCR_DECR line 1440) in util/decompile.c in Ming 0.4.8,\nwhich allows attackers to cause a denial of service via a crafted file.\n(CVE-2017-11729)\n\nA heap-based buffer over-read was found in the function OpCode (called\nfrom decompileINCR_DECR line 1474) in util/decompile.c in Ming 0.4.8,\nwhich allows attackers to cause a denial of service via a crafted file.\n(CVE-2017-11730)\n\nAn invalid memory read vulnerability was found in the function OpCode\n(called from isLogicalOp and decompileIF) in util/decompile.c in Ming\n0.4.8, which allows attackers to cause a denial of service via a crafted\nfile. (CVE-2017-11731)\n\nA heap-based buffer overflow vulnerability was found in the function\ndcputs (called from decompileIMPLEMENTS) in util/decompile.c in Ming\n0.4.8, which allows attackers to cause a denial of service via a\ncrafted file. (CVE-2017-11732)\n\nA null pointer dereference vulnerability was found in the function\nstackswap (called from decompileSTACKSWAP) in util/decompile.c in Ming\n0.4.8, which allows attackers to cause a denial of service via a crafted\nfile. (CVE-2017-11733)\n\nA heap-based buffer over-read was found in the function\ndecompileCALLFUNCTION in util/decompile.c in Ming 0.4.8, which allows\nattackers to cause a denial of service via a crafted file.\n(CVE-2017-11734)\n\nThe outputSWF_TEXT_RECORD function in util/outputscript.c in libming \u003c=\n0.4.8 is vulnerable to a NULL pointer dereference, which may allow\nattackers to cause a denial of service via a crafted swf file.\n(CVE-2017-16883)\n\nThe printMP3Headers function in util/listmp3.c in libming v0.4.8 or\nearlier is vulnerable to a global buffer overflow, which may allow\nattackers to cause a denial of service via a crafted file, a different\nvulnerability than CVE-2016-9264. (CVE-2017-16898)\n\nIn libming 0.4.8, there is an integer signedness error vulnerability\n(left shift of a negative value) in the readSBits function\n(util/read.c). Remote attackers can leverage this vulnerability to\ncause a denial of service via a crafted swf file. (CVE-2018-5251)\n\nIn libming 0.4.8, there is an integer overflow (caused by an\nout-of-range left shift) in the readUInt32 function (util/read.c).\nRemote attackers could leverage this vulnerability to cause a\ndenial-of-service via a crafted swf file. (CVE-2018-5294)\n\nThe outputSWF_TEXT_RECORD function (util/outputscript.c) in libming\nthrough 0.4.8 is vulnerable to an integer overflow and resultant\nout-of-bounds read, which may allow attackers to cause a denial of\nservice or unspecified other impact via a crafted SWF file.\n(CVE-2018-6315)\n\nThe decompileIF function (util/decompile.c) in libming through 0.4.8\nis vulnerable to a use-after-free, which may allow attackers to cause a\ndenial of service or unspecified other impact via a crafted SWF file.\n(CVE-2018-6359)\n","status":"published","published":"2018-04-30T19:08:07Z","modified":"2026-04-16T06:23:58.187628224Z","updated_at":"2026-11-02T15:49:40.442238Z"}]}}