An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

The remote host is affected by the vulnerability described in GLSA-201903-17 (SDL2_Image: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in SDL2_Image. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing a user to process a specially crafted       image file, could execute arbitrary code, cause a Denial of Service       condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

This update for SDL2_image fixes the following issues :

Security issues fixed :

  - CVE-2018-3839: Fixed an exploitable code execution     vulnerability that existed in the XCF image rendering     functionality of the Simple DirectMedia Layer     (bsc#1089087).

  - CVE-2018-3977: Fixed a possible code execution via     creafted XCF image that could have caused a heap     overflow (bsc#1114519).

Multiple vulnerabilities have been discovered in the image loading library for Simple DirectMedia Layer 1.2, which could result in denial of service or the execution of arbitrary code if malformed image files are opened.

Multiple vulnerabilities have been discovered in the image loading library for Simple DirectMedia Layer 2, which could result in denial of service or the execution of arbitrary code if malformed image files are opened.

ID	Name	Product	Family	Severity
123423	GLSA-201903-17 : SDL2_Image: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
123381	openSUSE Security Update : SDL2_image (openSUSE-2019-933)	Nessus	SuSE Local Security Checks	high
119141	openSUSE Security Update : SDL2_image (openSUSE-2018-1466)	Nessus	SuSE Local Security Checks	high
119083	openSUSE Security Update : SDL2_image (openSUSE-2018-1433)	Nessus	SuSE Local Security Checks	high
109413	Debian DSA-4184-1 : sdl-image1.2 - security update	Nessus	Debian Local Security Checks	high
109219	Debian DSA-4177-1 : libsdl2-image - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-3839

high

Tenable Plugins

high

high

high

high

high

high