PT-2019-17445 · Sdl+2 · Sdl2 Image+2
Cory Duplantis
·
Publicado
2019-07-11
·
Atualizado
2022-06-27
·
CVE-2019-5060
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
SDL2 image version 2.0.4
Description
A code execution issue exists in the XPM image rendering function. A specially crafted XPM image can cause an integer overflow in the
colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this issue.Recommendations
For version 2.0.4, consider disabling the XPM image rendering function until a patch is available. Restrict access to the
colorhash function to minimize the risk of exploitation. Avoid using the XPM image format in the affected function until the issue is resolved.Exploit
Correção
Memory Corruption
Integer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Sdl2 Image
Suse