PT-2019-17444 · Sdl+2 · Sdl2 Image+2

Publicado 2019-06-11 · Atualizado 2022-06-27 · CVE-2019-5059

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SDL2 image version 2.0.4

Description A code execution issue exists in the XPM image rendering functionality. A specially crafted XPM image can cause an integer overflow, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this issue.

Recommendations For SDL2 image version 2.0.4, consider disabling the XPM image rendering functionality until a patch is available. Restrict the use of specially crafted XPM images to minimize the risk of exploitation.

Correção

Memory Corruption

Integer Overflow

Enumeração de Fraquezas

CWE-787

CWE-190

Identificadores relacionados

ALT-PU-2021-1289

BDU:2026-06673

CVE-2019-5059

MGASA-2019-0363

MGASA-2019-0364

OPENSUSE-SU-2019:2070-1

OPENSUSE-SU-2019:2071-1

OPENSUSE-SU-2019:2108-1

OPENSUSE-SU-2019:2109-1

OPENSUSE-SU-2019_2070-1

OPENSUSE-SU-2019_2071-1

OPENSUSE-SU-2024:10608-1

OPENSUSE-SU-2024:10609-1

Produtos afetados

Alt Linux

Sdl2 Image

Suse

Referências · 61

• https://github.com/libsdl-org/SDL_image/commit/52b9d17eaf7b121c92328ce5d70c22be5739b0be · Nota
• https://bugzilla.suse.com/1135796 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-5059 · Aviso do Fabricante
• https://bugzilla.suse.com/1136101 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html · Aviso do Fabricante
• https://bugzilla.suse.com/1135789 · Nota
• https://bugzilla.suse.com/1140419 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=25767 · Nota
• https://bugzilla.suse.com/1135787 · Nota
• https://osv.dev/vulnerability/MGASA-2019-0364 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2019:2071-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-5059 · Nota
• https://bugzilla.suse.com/1140421 · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/3QX7GXNBMMTXZSXQVKMIC4P6EVVZNDRA/#3QX7GXNBMMTXZSXQVKMIC4P6EVVZNDRA · Nota