An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds read on the heap, resulting in information disclosure. An attacker can display a specially crafted image to trigger this vulnerability.

The remote host is affected by the vulnerability described in GLSA-201903-17 (SDL2_Image: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in SDL2_Image. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing a user to process a specially crafted       image file, could execute arbitrary code, cause a Denial of Service       condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities have been discovered in the image loading library for Simple DirectMedia Layer 1.2, which could result in denial of service or the execution of arbitrary code if malformed image files are opened.

Multiple vulnerabilities have been discovered in the image loading library for Simple DirectMedia Layer 2, which could result in denial of service or the execution of arbitrary code if malformed image files are opened.

ID	Name	Product	Family	Severity
123423	GLSA-201903-17 : SDL2_Image: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
109413	Debian DSA-4184-1 : sdl-image1.2 - security update	Nessus	Debian Local Security Checks	high
109219	Debian DSA-4177-1 : libsdl2-image - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-3838

medium

Tenable Plugins

high

high

high