An exploitable information disclosure vulnerability exists in the PCX image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted PCX image can cause an out-of-bounds read on the heap, resulting in information disclosure . An attacker can display a specially crafted image to trigger this vulnerability.

The remote host is affected by the vulnerability described in GLSA-201903-17 (SDL2_Image: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in SDL2_Image. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing a user to process a specially crafted       image file, could execute arbitrary code, cause a Denial of Service       condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

Security fix for CVE-2018-3977

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in the image loading library for Simple DirectMedia Layer 1.2, which could result in denial of service or the execution of arbitrary code if malformed image files are opened.

Multiple vulnerabilities have been discovered in the image loading library for Simple DirectMedia Layer 2, which could result in denial of service or the execution of arbitrary code if malformed image files are opened.

ID	Name	Product	Family	Severity
123423	GLSA-201903-17 : SDL2_Image: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
120873	Fedora 28 : mingw-SDL2_image (2018-e8d19367cb)	Nessus	Fedora Local Security Checks	high
120721	Fedora 29 : mingw-SDL2_image (2018-b38de02132)	Nessus	Fedora Local Security Checks	high
109413	Debian DSA-4184-1 : sdl-image1.2 - security update	Nessus	Debian Local Security Checks	high
109219	Debian DSA-4177-1 : libsdl2-image - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-3837

medium

Tenable Plugins

high

high

high

high

high