PT-2021-7990 · Sdl+5 · Sdl+5

Published 2021-11-30 · Updated 2025-07-03 · CVE-2021-33657

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SDL (Simple DirectMedia Layer) versions 2.x through 2.0.18

Description The issue is related to a heap overflow problem in the src/video/SDL pixels.c component of the Simple DirectMedia Layer library. This can be exploited by a remote attacker using a malicious .BMP file, potentially allowing them to access confidential data, compromise data integrity, and cause a denial of service or achieve code execution.

Recommendations For SDL (Simple DirectMedia Layer) versions 2.x through 2.0.18, update to a version later than 2.0.18 to resolve the issue. As a temporary workaround, consider restricting the use of .BMP files with the library until a patch is available.

Fix

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2022-1019

ALT-PU-2024-12812

ALT-PU-2024-17781

ALT-PU-2024-8940

BDU:2024-01494

CVE-2021-33657

DLA-3314-1

MGASA-2022-0326

MGASA-2022-0332

OESA-2022-1592

OPENSUSE-SU-2022_1218-1

OPENSUSE-SU-2022_1273-1

OPENSUSE-SU-2024:11984-1

OPENSUSE-SU-2024:13582-1

OPENSUSE-SU-2025:15205-1

OPENSUSE-SU-2025:15206-1

SUSE-SU-2022:1218-1

SUSE-SU-2022:1273-1

SUSE-SU-2022:1312-1

SUSE-SU-2022:1313-1

SUSE-SU-2022:14943-1

SUSE-SU-2022_1218-1

SUSE-SU-2022_1313-1

SUSE-SU-2022_14943-1

USN-5398-1

Affected Products

Alt Linux

Astra Linux

Debian

Sdl

Suse

Ubuntu

References · 69

• https://github.com/libsdl-org/SDL/commit/8c91cf7dba5193f5ce12d06db1336515851c9ee9 · Patch
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0212SE17 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01494 · Security Note
• https://security.gentoo.org/glsa/202305-18 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15206-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33657 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15205-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13582-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-33657 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0326.html · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0332 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-33657 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0326 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-33657 · Vendor Advisory