PT-2019-12706 · Simple Directmedia Layer+2 · Sdl2 Image+3

Hugo Lefeuvre · Published 2019-05-20 · Updated 2020-01-14 · CVE-2019-12220

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Simple DirectMedia Layer (SDL) version 2.0.9 SDL2 image version 2.0.4

Description An issue was discovered in libSDL2.a when used with libSDL2 image.a. There is an out-of-bounds read in the SDL FreePalette REAL function at video/SDL pixels.c.

Recommendations For Simple DirectMedia Layer (SDL) version 2.0.9, consider updating to a newer version to resolve the issue. For SDL2 image version 2.0.4, consider updating to a newer version to resolve the issue. As a temporary workaround, consider restricting the use of the SDL FreePalette REAL function until a patch is available.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2019-12220

DLA-1861-1

DLA-1865-1

MGASA-2019-0363

MGASA-2019-0364

OPENSUSE-SU-2019:2070-1

OPENSUSE-SU-2019:2108-1

OPENSUSE-SU-2019_2070-1

OPENSUSE-SU-2024:10608-1

USN-4238-1

Affected Products

Sdl

Sdl2 Image

Suse

Ubuntu

References · 66

• 🔥 https://bugzilla.libsdl.org/show_bug.cgi?id=4627 · Exploit
• https://osv.dev/vulnerability/DLA-1865-1 · Vendor Advisory
• https://usn.ubuntu.com/4238-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2070-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJ2VRD57UOBT72JUC2DIFHEFCH4N64SW · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12217 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0364.html · Security Note
• https://ubuntu.com/security/CVE-2019-13616 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0363.html · Security Note
• https://ubuntu.com/security/CVE-2019-12220 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12221 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2108-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-5051 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0364 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-7635 · Vendor Advisory