PT-2019-12703 · Simple Directmedia Layer+2 · Sdl2 Image+3

Hugo Lefeuvre · Published 2019-05-20 · Updated 2020-01-14 · CVE-2019-12217

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Simple DirectMedia Layer (SDL) version 2.0.9 SDL2 image version 2.0.4

Description An issue was discovered in libSDL2.a when used with libSDL2 image.a. There is a NULL pointer dereference in the stdio read function in the file SDL rwops.c.

Recommendations For Simple DirectMedia Layer (SDL) version 2.0.9, consider updating to a newer version to resolve the issue. For SDL2 image version 2.0.4, consider updating to a newer version to resolve the issue. As a temporary workaround, consider restricting the use of the stdio read function in SDL rwops.c until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2019-12217

DLA-1861-1

DLA-1865-1

MGASA-2019-0363

MGASA-2019-0364

OPENSUSE-SU-2019:2070-1

OPENSUSE-SU-2019:2108-1

OPENSUSE-SU-2019_2070-1

OPENSUSE-SU-2024:10608-1

USN-4238-1

Affected Products

Sdl

Sdl2 Image

Suse

Ubuntu

References · 68

• 🔥 https://bugzilla.libsdl.org/show_bug.cgi?id=4626 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-12217 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-12217 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1865-1 · Vendor Advisory
• https://usn.ubuntu.com/4238-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2070-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJ2VRD57UOBT72JUC2DIFHEFCH4N64SW · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12217 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0364.html · Security Note
• https://ubuntu.com/security/CVE-2019-13616 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12217 · Security Note
• https://advisories.mageia.org/MGASA-2019-0363.html · Security Note
• https://ubuntu.com/security/CVE-2019-12220 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12221 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2108-1 · Vendor Advisory