A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - SDL2: memory leak in GLES_CreateTexture() in render/opengles/SDL_render_gles.c (CVE-2022-4743)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The version of SDL2 installed on the remote host is prior to 2.0.10-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2162 advisory.

  - A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in     SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The     vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected. (CVE-2022-4743)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This Solaris system is missing necessary patches to address critical security updates :

The remote host is affected by the vulnerability described in GLSA-202305-18 (libsdl2: Multiple Vulnerabilities)

  - There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18     versions. By crafting a malicious .BMP file, an attacker can cause the application using this library to     crash, denial of service or Code execution. (CVE-2021-33657)

  - A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in     SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The     vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected. (CVE-2022-4743)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3314 advisory.

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c. (CVE-2019-13616)

  - SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buffer over-read in     Fill_IMA_ADPCM_block, caused by an integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c.
    (CVE-2019-13626)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in     IMA_ADPCM_nibble in audio/SDL_wave.c. (CVE-2019-7572)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef loop). (CVE-2019-7573)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     IMA_ADPCM_decode in audio/SDL_wave.c. (CVE-2019-7574)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in     MS_ADPCM_decode in audio/SDL_wave.c. (CVE-2019-7575)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop). (CVE-2019-7576)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in     SDL_LoadWAV_RW in audio/SDL_wave.c. (CVE-2019-7577)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitIMA_ADPCM in audio/SDL_wave.c. (CVE-2019-7578)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     Blit1to4 in video/SDL_blit_1.c. (CVE-2019-7635)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     SDL_GetRGB in video/SDL_pixels.c. (CVE-2019-7636)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     Map1toN in video/SDL_pixels.c. (CVE-2019-7638)

  - SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap     corruption) in SDL_BlitCopy in video/SDL_blit_copy.c via a crafted .BMP file. (CVE-2020-14409)

  - SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in     Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP file. (CVE-2020-14410)

  - There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18     versions. By crafting a malicious .BMP file, an attacker can cause the application using this library to     crash, denial of service or Code execution. (CVE-2021-33657)

  - A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in     SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The     vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected. (CVE-2022-4743)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0069-1 advisory.

  - A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in     SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The     vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected. (CVE-2022-4743)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199539	RHEL 9 : sdl2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
178822	Amazon Linux 2 : SDL2 (ALAS-2023-2162)	Nessus	Amazon Linux Local Security Checks	high
178626	Oracle Solaris Critical Patch Update : jul2023_SRU11_4_58_144_3	Nessus	Solaris Local Security Checks	critical
175053	GLSA-202305-18 : libsdl2: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
171377	Debian DLA-3314-1 : libsdl2 - LTS security update	Nessus	Debian Local Security Checks	high
169928	SUSE SLES15 / openSUSE 15 Security Update : SDL2 (SUSE-SU-2023:0069-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2022-4743

high

Tenable Plugins

high

high

critical

high

high

high