CVE-2024-28458

What it actually does

Null pointer dereference in compileSWFActionCode within action/actioncompiler.c causes the swfdump tool to crash when processing specially crafted input.

Why it matters to the business

Attackers can cause the affected multimedia processing tool to become unavailable, disrupting workflows that rely on it for file handling on Debian systems.

How an attack unfolds

An attacker supplies a malicious file to the vulnerable swfdump binary; the crafted content reaches compileSWFActionCode and triggers a null pointer access that terminates the process.

How to fix it

Upgrade gpac on Debian 11 to version 1.0.1+dfsg1-4+deb11u2 or later. Rebuild any locally compiled instances from patched source and verify the update resolves the crash condition.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the listed fixed release, then re-run the tool against known triggering test cases to ensure no crash occurs.

Typical attack path

1. Identify a system running the vulnerable version of the tool
2. Craft or obtain a file that exercises the defective code path
3. Invoke the tool against the file
4. Observe process termination

How to detect it

Review system and application logs for segmentation faults or abrupt terminations of the swfdump process when handling SWF content; correlate timestamps with file-processing jobs.

• compileSWFActionCode
• action/actioncompiler.c
• swfdump

What your security team should do

• Apply the listed package upgrade on all Debian 11 instances within the next maintenance window
• Scan build pipelines and CI systems for references to the affected version and pin to the patched release
• Add the tool binary to asset inventory and schedule periodic version checks