PT-2019-17444 · Sdl+2 · Sdl2 Image+2

Published 2019-06-11 · Updated 2022-06-27 · CVE-2019-5059

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SDL2 image version 2.0.4

Description A code execution issue exists in the XPM image rendering functionality. A specially crafted XPM image can cause an integer overflow, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this issue.

Recommendations For SDL2 image version 2.0.4, consider disabling the XPM image rendering functionality until a patch is available. Restrict the use of specially crafted XPM images to minimize the risk of exploitation.

Fix

Memory Corruption

Integer Overflow

Weakness Enumeration

CWE-787

CWE-190

Related Identifiers

ALT-PU-2021-1289

BDU:2026-06673

CVE-2019-5059

MGASA-2019-0363

MGASA-2019-0364

OPENSUSE-SU-2019:2070-1

OPENSUSE-SU-2019:2071-1

OPENSUSE-SU-2019:2108-1

OPENSUSE-SU-2019:2109-1

OPENSUSE-SU-2019_2070-1

OPENSUSE-SU-2019_2071-1

OPENSUSE-SU-2024:10608-1

OPENSUSE-SU-2024:10609-1

Affected Products

Alt Linux

Sdl2 Image

Suse

References · 61

• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-5059 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0364 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2071-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5059 · Security Note
• https://advisories.mageia.org/MGASA-2019-0363.html · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2019-5059 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0364.html · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-5059 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-5059 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory