An exploitable code execution vulnerability exists in the PCX image-rendering functionality of SDL2_image 2.0.4. A specially crafted PCX image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

This update for SDL_image fixes the following issues :

Update SDL_Image to new snapshot 1.2.12+hg695.

Security issues fixed :

  - TALOS-2019-0821 CVE-2019-5052: exploitable integer     overflow vulnerability when loading a PCX file     (boo#1140421)

  - TALOS-2019-0841 CVE-2019-5057: code execution     vulnerability in the PCX image-rendering functionality     of SDL2_image (boo#1143763)

  - TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF     image rendering can lead to code execution (boo#1143764)

  - TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM     image handling (boo#1143766)

  - TALOS-2019-0844 CVE-2019-5060: integer overflow in the     XPM image (boo#1143768)

  - CVE-2019-7635: heap-based buffer over-read in Blit1to4     in video/SDL_blit_1.c (boo#1124827)

  - CVE-2019-13616: fix heap buffer overflow when reading a     crafted bmp file (boo#1141844).

This update for SDL2_image fixes the following issues :

Update to new upstream release 2.0.5.

Security issues fixed :

  - TALOS-2019-0820 CVE-2019-5051: exploitable heap-based     buffer overflow vulnerability when loading a PCX file     (boo#1140419)

  - TALOS-2019-0821 CVE-2019-5052: exploitable integer     overflow vulnerability when loading a PCX file     (boo#1140421)

  - TALOS-2019-0841 CVE-2019-5057: code execution     vulnerability in the PCX image-rendering functionality     of SDL2_image (boo#1143763)

  - TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF     image rendering can lead to code execution (boo#1143764)

  - TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM     image (boo#1143766)

  - TALOS-2019-0844 CVE-2019-5060: integer overflow in the     XPM image (boo#1143768)

Not mentioned by upstream, but issues seemingly further fixed :

  - CVE-2019-12218: NULL pointer dereference in the     SDL2_image function IMG_LoadPCX_RW (boo#1135789)

  - CVE-2019-12217: NULL pointer dereference in the SDL     stdio_read function (boo#1135787)

  - CVE-2019-12220: SDL_image triggers an out-of-bounds read     in the SDL function SDL_FreePalette_REAL (boo#1135806)

  - CVE-2019-12221: a SEGV caused by SDL_image in SDL     function SDL_free_REAL in stdlib/SDL_malloc.c     (boo#1135796)

  - CVE-2019-12222: out-of-bounds read triggered by     SDL_image in the function SDL_InvalidateMap at     video/SDL_pixels.c (boo#1136101)

  - CVE-2019-13616: fix heap buffer overflow when reading a     crafted bmp file (boo#1141844).

SDL_image developers report :

Fixed a number of security issues :

- TALOS-2019-0820

- TALOS-2019-0821

- TALOS-2019-0841

- TALOS-2019-0842

- TALOS-2019-0843

- TALOS-2019-0844

ID	Name	Product	Family	Severity
128540	openSUSE Security Update : SDL_image (openSUSE-2019-2071)	Nessus	SuSE Local Security Checks	high
128539	openSUSE Security Update : SDL2_image (openSUSE-2019-2070)	Nessus	SuSE Local Security Checks	high
126484	FreeBSD : SDL2_image -- multiple vulnerabilities (3394bc2b-9da4-11e9-951e-14dae9d5a9d2)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2019-5057

high

Tenable Plugins

high

high

high