Home / mailings [gentoo-announce] [ GLSA 201903-17 ] SDL2_Image: Multiple vulnerabilities
Posted on 28 March 2019
Gentoo-announce- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201903-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: SDL2_Image: Multiple vulnerabilities
Date: March 28, 2019
Bugs: #655226, #674132
ID: 201903-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in the image loading library
for Simple DirectMedia Layer, the worst of which could result in the
remote execution of arbitrary code.
Background
==========
SDL_image is an image file library that loads images as SDL surfaces,
and supports various formats like BMP, GIF, JPEG, LBM, PCX, PNG, PNM,
TGA, TIFF, XCF, XPM, and XV.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 media-libs/sdl2-image < 2.0.4 >= 2.0.4
Description
===========
Multiple vulnerabilities have been discovered in SDL2_Image. Please
review the CVE identifiers referenced below for details.
Impact
======
A remote attacker, by enticing a user to process a specially crafted
image file, could execute arbitrary code, cause a Denial of Service
condition, or obtain sensitive information.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All SDL2_Image users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/sdl2-image-2.0.4"
References
==========
[ 1 ] CVE-2017-12122
https://nvd.nist.gov/vuln/detail/CVE-2017-12122
[ 2 ] CVE-2017-14440
https://nvd.nist.gov/vuln/detail/CVE-2017-14440
[ 3 ] CVE-2017-14441
https://nvd.nist.gov/vuln/detail/CVE-2017-14441
[ 4 ] CVE-2017-14442
https://nvd.nist.gov/vuln/detail/CVE-2017-14442
[ 5 ] CVE-2017-14448
https://nvd.nist.gov/vuln/detail/CVE-2017-14448
[ 6 ] CVE-2017-14449
https://nvd.nist.gov/vuln/detail/CVE-2017-14449
[ 7 ] CVE-2017-14450
https://nvd.nist.gov/vuln/detail/CVE-2017-14450
[ 8 ] CVE-2018-3837
https://nvd.nist.gov/vuln/detail/CVE-2018-3837
[ 9 ] CVE-2018-3838
https://nvd.nist.gov/vuln/detail/CVE-2018-3838
[ 10 ] CVE-2018-3839
https://nvd.nist.gov/vuln/detail/CVE-2018-3839
[ 11 ] CVE-2018-3977
https://nvd.nist.gov/vuln/detail/CVE-2018-3977
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201903-17
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2019 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
--JP+T4n/bALQSJXh8
Content-Type: application/pgp-signature; name="signature.asc"
