Cloudanix VulnDB

CVE-2021-42203

High · 7.8

CVSS

7.8

EPSS

1.3%

Published

Jun 2, 2022

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in software that handles certain animation files can let attackers take over a computer when the file is opened, so organizations should update the affected programs right away.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Full Compromise
Component
Application
Class
Use After Free
Remediation
No Fix Yet
Effort
Other
Patch risk
Other

What it actually does

Heap use-after-free in swf_FontExtract_DefineTextCallback allows arbitrary code execution when processing a malicious SWF file.

Why it matters to the business

Attackers can gain full control of affected systems through crafted input files, leading to data theft, service disruption, or further network compromise; prevalence in container tooling increases exposure in build and runtime pipelines.

How an attack unfolds

An attacker crafts a malicious SWF file that triggers the use-after-free during font text extraction; when the file is processed by an affected application the freed memory is reused for attacker-controlled data, resulting in code execution.

How to fix it

Upgrade containerd (Debian 11) to 1.4.13~ds1-1~deb11u3 or later and containerd/containerd (GIT) to commit a05d175400b1145e5e6a735a6710579d181e7fb0 or later; rebuild and redeploy any containers or images that embed the vulnerable library.

How to confirm the fix worked

Confirm package versions match the fixed releases, run regression tests with known-trigger SWF samples, and verify absence of the vulnerable function in binary or source after upgrade.

Typical attack path

  1. Craft malicious SWF containing malformed DefineText records
  2. Deliver file to target application or service that invokes swf_FontExtract_DefineTextCallback
  3. Trigger parsing path that frees the font structure while references remain
  4. Reuse freed memory to hijack control flow and execute arbitrary code

How to detect it

Review application logs for unexpected crashes or errors during SWF parsing, monitor process execution following SWF file access, and inspect memory dumps or core files for signs of heap corruption around font extraction routines.

What your security team should do

  • Apply the listed fixed versions immediately on all Debian 11 and GIT-based containerd deployments
  • Scan container images and build pipelines for the vulnerable swftools component
  • Add SWF file validation or sandboxing for any workflow that processes untrusted SWF content

The record

An issue was discovered in swftools through 20201222. A heap-use-after-free exists in the function swf_FontExtract_DefineTextCallback() located in swftext.c. It allows an attacker to cause code execution.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:16.04:LTS swftools 0 No fix
Ubuntu:18.04:LTS swftools 0 No fix
Ubuntu:Pro:16.04:LTS swftools 0 No fix
Ubuntu:Pro:18.04:LTS swftools 0 No fix

Related vulnerabilities