A flaw was found with the RHSA-2019:3950 erratum, where it did not fix the CVE-2019-13616 SDL vulnerability. This issue only affects Red Hat SDL packages, SDL versions through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow flaw while copying an existing surface into a new optimized one, due to a lack of validation while loading a BMP image, is possible. An application that uses SDL to parse untrusted input files may be vulnerable to this flaw, which could allow an attacker to make the application crash or execute code.

An update for SDL is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Simple DirectMedia Layer (SDL) is a cross-platform multimedia library designed to provide fast access to the graphics frame buffer and audio device.

Security Fix(es) :

* SDL: CVE-2019-13616 not fixed in Red Hat Enterprise Linux 7 erratum RHSA-2019:3950 (CVE-2019-14906)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has SDL packages installed that are affected by a vulnerability:

  - A flaw was found with the RHSA-2019:3950 erratum, where     it did not fix the CVE-2019-13616 SDL vulnerability.
    This issue only affects Red Hat SDL packages, SDL     versions through 1.2.15 and 2.x through 2.0.9 has a     heap-based buffer overflow flaw while copying an     existing surface into a new optimized one, due to a lack     of validation while loading a BMP image, is possible. An     application that uses SDL to parse untrusted input files     may be vulnerable to this flaw, which could allow an     attacker to make the application crash or execute code.
    (CVE-2019-14906)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has SDL packages installed that are affected by a vulnerability: Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version number.

A heap-based buffer overflow flaw, in SDL while copying an existing surface into a new optimized one, due to a lack of validation while loading a BMP image, is possible. An application that uses SDL to parse untrusted input files may be vulnerable to this flaw, which could allow an attacker to make the application crash or execute code.(CVE-2019-14906)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.(CVE-2019-13616)

A heap-based buffer overflow was discovered in SDL in the SDL_BlitCopy() function, that was called while copying an existing surface into a new optimized one, due to lack of validation while loading a BMP image in the SDL_LoadBMP_RW() function. An application that uses SDL to parse untrusted input files may be vulnerable to this flaw, which could allow an attacker to make the application crash or possibly execute code.(CVE-2019-13616)

An update for SDL is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Simple DirectMedia Layer (SDL) is a cross-platform multimedia library designed to provide fast access to the graphics frame buffer and audio device.

Security Fix(es) :

* SDL: CVE-2019-13616 not fixed in Red Hat Enterprise Linux 7 erratum RHSA-2019:3950 (CVE-2019-14906)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Security Fix(es) :

  - SDL: CVE-2019-13616 not fixed in Red Hat Enterprise     Linux 7 erratum RHSA-2019:3950 (CVE-2019-14906)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:4024 advisory.

    Simple DirectMedia Layer (SDL) is a cross-platform multimedia library designed to provide fast access to     the graphics frame buffer and audio device.

    Security Fix(es):

    * SDL: CVE-2019-13616 not fixed in Red Hat Enterprise Linux 7 erratum RHSA-2019:3950 (CVE-2019-14906)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4024 advisory.

    - Fix CVE-2019-13616 (a heap buffer over-read in BlitNtoN) (bug #1747237)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
144044	Virtuozzo 7 : SDL / SDL-devel / SDL-static (VZLSA-2019-4024)	Nessus	Virtuozzo Local Security Checks	critical
133082	NewStart CGSL CORE 5.05 / MAIN 5.05 : SDL Vulnerability (NS-SA-2020-0007)	Nessus	NewStart CGSL Local Security Checks	critical
132439	NewStart CGSL CORE 5.04 / MAIN 5.04 : SDL Vulnerability (NS-SA-2019-0263)	Nessus	NewStart CGSL Local Security Checks	critical
132263	Amazon Linux 2 : SDL (ALAS-2019-1375)	Nessus	Amazon Linux Local Security Checks	critical
131779	CentOS 7 : SDL (CESA-2019:4024)	Nessus	CentOS Local Security Checks	critical
131679	Scientific Linux Security Update : SDL on SL7.x x86_64 (20191202)	Nessus	Scientific Linux Local Security Checks	critical
131526	RHEL 7 : SDL (RHSA-2019:4024)	Nessus	Red Hat Local Security Checks	critical
131521	Oracle Linux 7 : SDL (ELSA-2019-4024)	Nessus	Oracle Linux Local Security Checks	critical

Detections

Analytics

CVE-2019-14906

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical