PT-2019-17445 · Sdl+2 · Sdl2 Image+2

Cory Duplantis · Published 2019-07-11 · Updated 2022-06-27 · CVE-2019-5060

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SDL2 image version 2.0.4

Description A code execution issue exists in the XPM image rendering function. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this issue.

Recommendations For version 2.0.4, consider disabling the XPM image rendering function until a patch is available. Restrict access to the colorhash function to minimize the risk of exploitation. Avoid using the XPM image format in the affected function until the issue is resolved.

Exploit

Fix

Memory Corruption

Integer Overflow

Weakness Enumeration

CWE-787

CWE-190

Related Identifiers

ALT-PU-2021-1289

BDU:2026-06674

CVE-2019-5060

MGASA-2019-0363

MGASA-2019-0364

OPENSUSE-SU-2019:2070-1

OPENSUSE-SU-2019:2071-1

OPENSUSE-SU-2019:2108-1

OPENSUSE-SU-2019:2109-1

OPENSUSE-SU-2019_2070-1

OPENSUSE-SU-2019_2071-1

OPENSUSE-SU-2024:10608-1

OPENSUSE-SU-2024:10609-1

Affected Products

Alt Linux

Sdl2 Image

Suse

References · 61

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0844 · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0364 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2071-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-5060 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5060 · Security Note
• https://advisories.mageia.org/MGASA-2019-0363.html · Security Note
• https://bdu.fstec.ru/vul/2026-06674 · Security Note
• https://advisories.mageia.org/MGASA-2019-0364.html · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-5060 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-5060 · Vendor Advisory