Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2019-5051 (GCVE-0-2019-5051)
Vulnerability from cvelistv5
Published
2019-07-03 18:43
Modified
2024-08-04 19:47
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-390 - Detection of Error Condition Without Action
Summary
An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
n/a | Simple DirectMedia |
Version: Simple DirectMedia Layer SDL2_image 2.0.4 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T19:47:55.830Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "[debian-lts-announce] 20190727 [SECURITY] [DLA 1865-1] sdl-image1.2 security update", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html" }, { "name": "openSUSE-SU-2019:2070", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html" }, { "name": "openSUSE-SU-2019:2108", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html" }, { "name": "USN-4238-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "https://usn.ubuntu.com/4238-1/" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Simple DirectMedia", "vendor": "n/a", "versions": [ { "status": "affected", "version": "Simple DirectMedia Layer SDL2_image 2.0.4" } ] } ], "descriptions": [ { "lang": "en", "value": "An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability." } ], "metrics": [ { "cvssV3_0": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-390", "description": "CWE-390: Detection of Error Condition Without Action", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-04-19T17:33:25", "orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos" }, "references": [ { "name": "[debian-lts-announce] 20190727 [SECURITY] [DLA 1865-1] sdl-image1.2 security update", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html" }, { "name": "openSUSE-SU-2019:2070", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html" }, { "name": "openSUSE-SU-2019:2108", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html" }, { "name": "USN-4238-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "https://usn.ubuntu.com/4238-1/" }, { "tags": [ "x_refsource_MISC" ], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "talos-cna@cisco.com", "ID": "CVE-2019-5051", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Simple DirectMedia", "version": { "version_data": [ { "version_value": "Simple DirectMedia Layer SDL2_image 2.0.4" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability." } ] }, "impact": { "cvss": { "baseScore": 8.8, "baseSeverity": "High", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-390: Detection of Error Condition Without Action" } ] } ] }, "references": { "reference_data": [ { "name": "[debian-lts-announce] 20190727 [SECURITY] [DLA 1865-1] sdl-image1.2 security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html" }, { "name": "openSUSE-SU-2019:2070", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html" }, { "name": "openSUSE-SU-2019:2108", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html" }, { "name": "USN-4238-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4238-1/" }, { "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820", "refsource": "MISC", "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820" } ] } } } }, "cveMetadata": { "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "assignerShortName": "talos", "cveId": "CVE-2019-5051", "datePublished": "2019-07-03T18:43:48", "dateReserved": "2019-01-04T00:00:00", "dateUpdated": "2024-08-04T19:47:55.830Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2019-5051\",\"sourceIdentifier\":\"talos-cna@cisco.com\",\"published\":\"2019-07-03T19:15:12.613\",\"lastModified\":\"2024-11-21T04:44:15.193\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.\"},{\"lang\":\"es\",\"value\":\"Existe una vulnerabilidad explotable de desbordamiento de b\u00fafer basado en memoria din\u00e1mica (heap) cuando se carga un archivo PCX en SDL2_image, versi\u00f3n 2.0.4. La falta de un manejador de errores puede provocar un desbordamiento del b\u00fafer y una posible ejecuci\u00f3n de c\u00f3digo. Un atacante puede proporcionar un archivo de imagen especialmente manipulado para activar esta vulnerabilidad.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV30\":[{\"source\":\"talos-cna@cisco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"talos-cna@cisco.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-390\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-755\"},{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libsdl:sdl2_image:2.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9FE1954-01A5-4B9A-8D4C-9DAD120C3B56\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"D83DA865-E4A6-4FBF-AA1B-A969EBA6B2AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"40513095-7E6E-46B3-B604-C926F1BA3568\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1E78106-58E6-4D59-990F-75DA575BFAD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B620311B-34A3-48A6-82DF-6F078D7A4493\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*\",\"matchCriteriaId\":\"7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html\",\"source\":\"talos-cna@cisco.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html\",\"source\":\"talos-cna@cisco.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html\",\"source\":\"talos-cna@cisco.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820\",\"source\":\"talos-cna@cisco.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4238-1/\",\"source\":\"talos-cna@cisco.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4238-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
ghsa-wxjc-cpqc-xw6q
Vulnerability from github
Published
2022-05-24 16:49
Modified
2022-06-28 00:00
Severity ?
VLAI Severity ?
Details
An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.
{ "affected": [], "aliases": [ "CVE-2019-5051" ], "database_specific": { "cwe_ids": [ "CWE-787" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2019-07-03T19:15:00Z", "severity": "HIGH" }, "details": "An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.", "id": "GHSA-wxjc-cpqc-xw6q", "modified": "2022-06-28T00:00:51Z", "published": "2022-05-24T16:49:23Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5051" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html" }, { "type": "WEB", "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820" }, { "type": "WEB", "url": "https://usn.ubuntu.com/4238-1" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ] }
gsd-2019-5051
Vulnerability from gsd
Modified
2023-12-13 01:23
Details
An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2019-5051", "description": "An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.", "id": "GSD-2019-5051", "references": [ "https://www.suse.com/security/cve/CVE-2019-5051.html", "https://ubuntu.com/security/CVE-2019-5051", "https://advisories.mageia.org/CVE-2019-5051.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2019-5051" ], "details": "An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.", "id": "GSD-2019-5051", "modified": "2023-12-13T01:23:55.220028Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "talos-cna@cisco.com", "ID": "CVE-2019-5051", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Simple DirectMedia", "version": { "version_data": [ { "version_value": "Simple DirectMedia Layer SDL2_image 2.0.4" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability." } ] }, "impact": { "cvss": { "baseScore": 8.8, "baseSeverity": "High", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-390: Detection of Error Condition Without Action" } ] } ] }, "references": { "reference_data": [ { "name": "[debian-lts-announce] 20190727 [SECURITY] [DLA 1865-1] sdl-image1.2 security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html" }, { "name": "openSUSE-SU-2019:2070", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html" }, { "name": "openSUSE-SU-2019:2108", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html" }, { "name": "USN-4238-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4238-1/" }, { "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820", "refsource": "MISC", "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:libsdl:sdl2_image:2.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "talos-cna@cisco.com", "ID": "CVE-2019-5051" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-787" }, { "lang": "en", "value": "CWE-755" } ] } ] }, "references": { "reference_data": [ { "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820", "refsource": "MISC", "tags": [ "Exploit", "Third Party Advisory" ], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820" }, { "name": "[debian-lts-announce] 20190727 [SECURITY] [DLA 1865-1] sdl-image1.2 security update", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html" }, { "name": "openSUSE-SU-2019:2070", "refsource": "SUSE", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html" }, { "name": "openSUSE-SU-2019:2108", "refsource": "SUSE", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html" }, { "name": "USN-4238-1", "refsource": "UBUNTU", "tags": [ "Third Party Advisory" ], "url": "https://usn.ubuntu.com/4238-1/" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 2.8, "impactScore": 5.9 } }, "lastModifiedDate": "2022-06-27T17:29Z", "publishedDate": "2019-07-03T19:15Z" } } }
opensuse-su-2019:2108-1
Vulnerability from csaf_opensuse
Published
2019-09-10 14:20
Modified
2019-09-10 14:20
Summary
Security update for SDL2_image
Notes
Title of the patch
Security update for SDL2_image
Description of the patch
This update for SDL2_image fixes the following issues:
Update to new upstream release 2.0.5.
Security issues fixed:
* TALOS-2019-0820 CVE-2019-5051: exploitable heap-based buffer overflow vulnerability when loading a PCX file (boo#1140419)
* TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421)
* TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763)
* TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764)
* TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image (boo#1143766)
* TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768)
Not mentioned by upstream, but issues seemingly further fixed:
* CVE-2019-12218: NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW (boo#1135789)
* CVE-2019-12217: NULL pointer dereference in the SDL stdio_read function (boo#1135787)
* CVE-2019-12220: SDL_image triggers an out-of-bounds read in the SDL function SDL_FreePalette_REAL (boo#1135806)
* CVE-2019-12221: a SEGV caused by SDL_image in SDL function SDL_free_REAL in stdlib/SDL_malloc.c (boo#1135796)
* CVE-2019-12222: out-of-bounds read triggered by SDL_image in the function SDL_InvalidateMap at video/SDL_pixels.c (boo#1136101)
* CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844).
This update was imported from the openSUSE:Leap:15.0:Update update project.
Patchnames
openSUSE-2019-2108
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for SDL2_image", "title": "Title of the patch" }, { "category": "description", "text": "This update for SDL2_image fixes the following issues:\n\nUpdate to new upstream release 2.0.5.\n\nSecurity issues fixed:\n\n* TALOS-2019-0820 CVE-2019-5051: exploitable heap-based buffer overflow vulnerability when loading a PCX file (boo#1140419)\n* TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421)\n* TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763)\n* TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764)\n* TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image (boo#1143766)\n* TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768)\n\nNot mentioned by upstream, but issues seemingly further fixed:\n\n* CVE-2019-12218: NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW (boo#1135789)\n* CVE-2019-12217: NULL pointer dereference in the SDL stdio_read function (boo#1135787)\n* CVE-2019-12220: SDL_image triggers an out-of-bounds read in the SDL function SDL_FreePalette_REAL (boo#1135806)\n* CVE-2019-12221: a SEGV caused by SDL_image in SDL function SDL_free_REAL in stdlib/SDL_malloc.c (boo#1135796)\n* CVE-2019-12222: out-of-bounds read triggered by SDL_image in the function SDL_InvalidateMap at video/SDL_pixels.c (boo#1136101)\n* CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844).\n\n\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-2019-2108", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2019_2108-1.json" }, { "category": "self", "summary": "URL for openSUSE-SU-2019:2108-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/L64IV5QDMXKI6JPESXNTCMESEKNUADR2/#L64IV5QDMXKI6JPESXNTCMESEKNUADR2" }, { "category": "self", "summary": "E-Mail link for openSUSE-SU-2019:2108-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/L64IV5QDMXKI6JPESXNTCMESEKNUADR2/#L64IV5QDMXKI6JPESXNTCMESEKNUADR2" }, { "category": "self", "summary": "SUSE Bug 1135787", "url": "https://bugzilla.suse.com/1135787" }, { "category": "self", "summary": "SUSE Bug 1135789", "url": "https://bugzilla.suse.com/1135789" }, { "category": "self", "summary": "SUSE Bug 1135796", "url": "https://bugzilla.suse.com/1135796" }, { "category": "self", "summary": "SUSE Bug 1135806", "url": "https://bugzilla.suse.com/1135806" }, { "category": "self", "summary": "SUSE Bug 1136101", "url": "https://bugzilla.suse.com/1136101" }, { "category": "self", "summary": "SUSE Bug 1140419", "url": "https://bugzilla.suse.com/1140419" }, { "category": "self", "summary": "SUSE Bug 1140421", "url": "https://bugzilla.suse.com/1140421" }, { "category": "self", "summary": "SUSE Bug 1141844", "url": "https://bugzilla.suse.com/1141844" }, { "category": "self", "summary": "SUSE Bug 1143763", "url": "https://bugzilla.suse.com/1143763" }, { "category": "self", "summary": "SUSE Bug 1143764", "url": "https://bugzilla.suse.com/1143764" }, { "category": "self", "summary": "SUSE Bug 1143766", "url": "https://bugzilla.suse.com/1143766" }, { "category": "self", "summary": "SUSE Bug 1143768", "url": "https://bugzilla.suse.com/1143768" }, { "category": "self", "summary": "SUSE CVE CVE-2019-12217 page", "url": "https://www.suse.com/security/cve/CVE-2019-12217/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-12218 page", "url": "https://www.suse.com/security/cve/CVE-2019-12218/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-12220 page", "url": "https://www.suse.com/security/cve/CVE-2019-12220/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-12221 page", "url": "https://www.suse.com/security/cve/CVE-2019-12221/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-12222 page", "url": "https://www.suse.com/security/cve/CVE-2019-12222/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13616 page", "url": "https://www.suse.com/security/cve/CVE-2019-13616/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5051 page", "url": "https://www.suse.com/security/cve/CVE-2019-5051/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5052 page", "url": "https://www.suse.com/security/cve/CVE-2019-5052/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5057 page", "url": "https://www.suse.com/security/cve/CVE-2019-5057/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5058 page", "url": "https://www.suse.com/security/cve/CVE-2019-5058/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5059 page", "url": "https://www.suse.com/security/cve/CVE-2019-5059/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5060 page", "url": "https://www.suse.com/security/cve/CVE-2019-5060/" } ], "title": "Security update for SDL2_image", "tracking": { "current_release_date": "2019-09-10T14:20:24Z", "generator": { "date": "2019-09-10T14:20:24Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2019:2108-1", "initial_release_date": "2019-09-10T14:20:24Z", "revision_history": [ { "date": "2019-09-10T14:20:24Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "product": { "name": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "product_id": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64" } }, { "category": "product_version", "name": "libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "product": { "name": "libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "product_id": "libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "product": { "name": "libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "product_id": "libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" } }, { "category": "product_version", "name": "libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "product": { "name": "libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "product_id": "libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" } } ], "category": "architecture", "name": "aarch64_ilp32" }, { "branches": [ { "category": "product_version", "name": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "product": { "name": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "product_id": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le" } }, { "category": "product_version", "name": "libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "product": { "name": "libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "product_id": "libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "product": { "name": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "product_id": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x" } }, { "category": "product_version", "name": "libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "product": { "name": "libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "product_id": "libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "product": { "name": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "product_id": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64" } }, { "category": "product_version", "name": "libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "product": { "name": "libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "product_id": "libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Package Hub 15", "product": { "name": "SUSE Package Hub 15", "product_id": "SUSE Package Hub 15" } }, { "category": "product_name", "name": "SUSE Package Hub 15 SP1", "product": { "name": "SUSE Package Hub 15 SP1", "product_id": "SUSE Package Hub 15 SP1" } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64 as component of SUSE Package Hub 15", "product_id": "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64" }, "product_reference": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "relates_to_product_reference": "SUSE Package Hub 15" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le as component of SUSE Package Hub 15", "product_id": "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le" }, "product_reference": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "relates_to_product_reference": "SUSE Package Hub 15" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x as component of SUSE Package Hub 15", "product_id": "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x" }, "product_reference": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "relates_to_product_reference": "SUSE Package Hub 15" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64 as component of SUSE Package Hub 15", "product_id": "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64" }, "product_reference": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "relates_to_product_reference": "SUSE Package Hub 15" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32 as component of SUSE Package Hub 15", "product_id": "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" }, "product_reference": "libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "relates_to_product_reference": "SUSE Package Hub 15" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64 as component of SUSE Package Hub 15", "product_id": "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64" }, "product_reference": "libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "relates_to_product_reference": "SUSE Package Hub 15" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le as component of SUSE Package Hub 15", "product_id": "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le" }, "product_reference": "libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "relates_to_product_reference": "SUSE Package Hub 15" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x as component of SUSE Package Hub 15", "product_id": "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x" }, "product_reference": "libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "relates_to_product_reference": "SUSE Package Hub 15" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64 as component of SUSE Package Hub 15", "product_id": "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64" }, "product_reference": "libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "relates_to_product_reference": "SUSE Package Hub 15" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32 as component of SUSE Package Hub 15", "product_id": "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" }, "product_reference": "libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "relates_to_product_reference": "SUSE Package Hub 15" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64 as component of SUSE Package Hub 15 SP1", "product_id": "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64" }, "product_reference": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "relates_to_product_reference": "SUSE Package Hub 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le as component of SUSE Package Hub 15 SP1", "product_id": "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le" }, "product_reference": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "relates_to_product_reference": "SUSE Package Hub 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x as component of SUSE Package Hub 15 SP1", "product_id": "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x" }, "product_reference": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "relates_to_product_reference": "SUSE Package Hub 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64 as component of SUSE Package Hub 15 SP1", "product_id": "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64" }, "product_reference": "libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "relates_to_product_reference": "SUSE Package Hub 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32 as component of SUSE Package Hub 15 SP1", "product_id": "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" }, "product_reference": "libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "relates_to_product_reference": "SUSE Package Hub 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64 as component of SUSE Package Hub 15 SP1", "product_id": "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64" }, "product_reference": "libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "relates_to_product_reference": "SUSE Package Hub 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le as component of SUSE Package Hub 15 SP1", "product_id": "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le" }, "product_reference": "libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "relates_to_product_reference": "SUSE Package Hub 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x as component of SUSE Package Hub 15 SP1", "product_id": "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x" }, "product_reference": "libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "relates_to_product_reference": "SUSE Package Hub 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64 as component of SUSE Package Hub 15 SP1", "product_id": "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64" }, "product_reference": "libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "relates_to_product_reference": "SUSE Package Hub 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32 as component of SUSE Package Hub 15 SP1", "product_id": "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" }, "product_reference": "libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "relates_to_product_reference": "SUSE Package Hub 15 SP1" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-12217", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-12217" } ], "notes": [ { "category": "general", "text": "An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL stdio_read function in file/SDL_rwops.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] }, "references": [ { "category": "external", "summary": "CVE-2019-12217", "url": "https://www.suse.com/security/cve/CVE-2019-12217" }, { "category": "external", "summary": "SUSE Bug 1135787 for CVE-2019-12217", "url": "https://bugzilla.suse.com/1135787" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "threats": [ { "category": "impact", "date": "2019-09-10T14:20:24Z", "details": "moderate" } ], "title": "CVE-2019-12217" }, { "cve": "CVE-2019-12218", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-12218" } ], "notes": [ { "category": "general", "text": "An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] }, "references": [ { "category": "external", "summary": "CVE-2019-12218", "url": "https://www.suse.com/security/cve/CVE-2019-12218" }, { "category": "external", "summary": "SUSE Bug 1135789 for CVE-2019-12218", "url": "https://bugzilla.suse.com/1135789" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "threats": [ { "category": "impact", "date": "2019-09-10T14:20:24Z", "details": "moderate" } ], "title": "CVE-2019-12218" }, { "cve": "CVE-2019-12220", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-12220" } ], "notes": [ { "category": "general", "text": "An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an out-of-bounds read in the SDL function SDL_FreePalette_REAL at video/SDL_pixels.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] }, "references": [ { "category": "external", "summary": "CVE-2019-12220", "url": "https://www.suse.com/security/cve/CVE-2019-12220" }, { "category": "external", "summary": "SUSE Bug 1135806 for CVE-2019-12220", "url": "https://bugzilla.suse.com/1135806" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "threats": [ { "category": "impact", "date": "2019-09-10T14:20:24Z", "details": "moderate" } ], "title": "CVE-2019-12220" }, { "cve": "CVE-2019-12221", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-12221" } ], "notes": [ { "category": "general", "text": "An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a SEGV in the SDL function SDL_free_REAL at stdlib/SDL_malloc.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] }, "references": [ { "category": "external", "summary": "CVE-2019-12221", "url": "https://www.suse.com/security/cve/CVE-2019-12221" }, { "category": "external", "summary": "SUSE Bug 1135796 for CVE-2019-12221", "url": "https://bugzilla.suse.com/1135796" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "threats": [ { "category": "impact", "date": "2019-09-10T14:20:24Z", "details": "moderate" } ], "title": "CVE-2019-12221" }, { "cve": "CVE-2019-12222", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-12222" } ], "notes": [ { "category": "general", "text": "An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the function SDL_InvalidateMap at video/SDL_pixels.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] }, "references": [ { "category": "external", "summary": "CVE-2019-12222", "url": "https://www.suse.com/security/cve/CVE-2019-12222" }, { "category": "external", "summary": "SUSE Bug 1136101 for CVE-2019-12222", "url": "https://bugzilla.suse.com/1136101" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "threats": [ { "category": "impact", "date": "2019-09-10T14:20:24Z", "details": "moderate" } ], "title": "CVE-2019-12222" }, { "cve": "CVE-2019-13616", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-13616" } ], "notes": [ { "category": "general", "text": "SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] }, "references": [ { "category": "external", "summary": "CVE-2019-13616", "url": "https://www.suse.com/security/cve/CVE-2019-13616" }, { "category": "external", "summary": "SUSE Bug 1141844 for CVE-2019-13616", "url": "https://bugzilla.suse.com/1141844" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "threats": [ { "category": "impact", "date": "2019-09-10T14:20:24Z", "details": "moderate" } ], "title": "CVE-2019-13616" }, { "cve": "CVE-2019-5051", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5051" } ], "notes": [ { "category": "general", "text": "An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5051", "url": "https://www.suse.com/security/cve/CVE-2019-5051" }, { "category": "external", "summary": "SUSE Bug 1140419 for CVE-2019-5051", "url": "https://bugzilla.suse.com/1140419" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "threats": [ { "category": "impact", "date": "2019-09-10T14:20:24Z", "details": "moderate" } ], "title": "CVE-2019-5051" }, { "cve": "CVE-2019-5052", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5052" } ], "notes": [ { "category": "general", "text": "An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A specially crafted file can cause an integer overflow, resulting in too little memory being allocated, which can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5052", "url": "https://www.suse.com/security/cve/CVE-2019-5052" }, { "category": "external", "summary": "SUSE Bug 1140421 for CVE-2019-5052", "url": "https://bugzilla.suse.com/1140421" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "threats": [ { "category": "impact", "date": "2019-09-10T14:20:24Z", "details": "moderate" } ], "title": "CVE-2019-5052" }, { "cve": "CVE-2019-5057", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5057" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the PCX image-rendering functionality of SDL2_image 2.0.4. A specially crafted PCX image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5057", "url": "https://www.suse.com/security/cve/CVE-2019-5057" }, { "category": "external", "summary": "SUSE Bug 1143763 for CVE-2019-5057", "url": "https://bugzilla.suse.com/1143763" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "threats": [ { "category": "impact", "date": "2019-09-10T14:20:24Z", "details": "moderate" } ], "title": "CVE-2019-5057" }, { "cve": "CVE-2019-5058", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5058" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5058", "url": "https://www.suse.com/security/cve/CVE-2019-5058" }, { "category": "external", "summary": "SUSE Bug 1143764 for CVE-2019-5058", "url": "https://bugzilla.suse.com/1143764" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "threats": [ { "category": "impact", "date": "2019-09-10T14:20:24Z", "details": "moderate" } ], "title": "CVE-2019-5058" }, { "cve": "CVE-2019-5059", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5059" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow, allocating too small of a buffer. This buffer can then be written out of bounds resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5059", "url": "https://www.suse.com/security/cve/CVE-2019-5059" }, { "category": "external", "summary": "SUSE Bug 1143766 for CVE-2019-5059", "url": "https://bugzilla.suse.com/1143766" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "threats": [ { "category": "impact", "date": "2019-09-10T14:20:24Z", "details": "moderate" } ], "title": "CVE-2019-5059" }, { "cve": "CVE-2019-5060", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5060" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5060", "url": "https://www.suse.com/security/cve/CVE-2019-5060" }, { "category": "external", "summary": "SUSE Bug 1143768 for CVE-2019-5060", "url": "https://bugzilla.suse.com/1143768" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15 SP1:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15 SP1:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-2_0-0-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-2_0-0-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.aarch64", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.ppc64le", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.s390x", "SUSE Package Hub 15:libSDL2_image-devel-2.0.5-bp151.4.3.1.x86_64", "SUSE Package Hub 15:libSDL2_image-devel-64bit-2.0.5-bp151.4.3.1.aarch64_ilp32" ] } ], "threats": [ { "category": "impact", "date": "2019-09-10T14:20:24Z", "details": "important" } ], "title": "CVE-2019-5060" } ] }
opensuse-su-2024:10608-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
libSDL2_image-2_0-0-2.0.5-1.14 on GA media
Notes
Title of the patch
libSDL2_image-2_0-0-2.0.5-1.14 on GA media
Description of the patch
These are all security issues fixed in the libSDL2_image-2_0-0-2.0.5-1.14 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-10608
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "libSDL2_image-2_0-0-2.0.5-1.14 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the libSDL2_image-2_0-0-2.0.5-1.14 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-10608", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10608-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2017-12122 page", "url": "https://www.suse.com/security/cve/CVE-2017-12122/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-14440 page", "url": "https://www.suse.com/security/cve/CVE-2017-14440/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-14441 page", "url": "https://www.suse.com/security/cve/CVE-2017-14441/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-14442 page", "url": "https://www.suse.com/security/cve/CVE-2017-14442/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-14448 page", "url": "https://www.suse.com/security/cve/CVE-2017-14448/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-14449 page", "url": "https://www.suse.com/security/cve/CVE-2017-14449/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-14450 page", "url": "https://www.suse.com/security/cve/CVE-2017-14450/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-2887 page", "url": "https://www.suse.com/security/cve/CVE-2017-2887/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-3839 page", "url": "https://www.suse.com/security/cve/CVE-2018-3839/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-3977 page", "url": "https://www.suse.com/security/cve/CVE-2018-3977/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-12217 page", "url": "https://www.suse.com/security/cve/CVE-2019-12217/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-12218 page", "url": "https://www.suse.com/security/cve/CVE-2019-12218/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-12220 page", "url": "https://www.suse.com/security/cve/CVE-2019-12220/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-12221 page", "url": "https://www.suse.com/security/cve/CVE-2019-12221/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-12222 page", "url": "https://www.suse.com/security/cve/CVE-2019-12222/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13616 page", "url": "https://www.suse.com/security/cve/CVE-2019-13616/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5051 page", "url": "https://www.suse.com/security/cve/CVE-2019-5051/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5052 page", "url": "https://www.suse.com/security/cve/CVE-2019-5052/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5057 page", "url": "https://www.suse.com/security/cve/CVE-2019-5057/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5058 page", "url": "https://www.suse.com/security/cve/CVE-2019-5058/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5059 page", "url": "https://www.suse.com/security/cve/CVE-2019-5059/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5060 page", "url": "https://www.suse.com/security/cve/CVE-2019-5060/" } ], "title": "libSDL2_image-2_0-0-2.0.5-1.14 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:10608-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "product": { "name": "libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "product_id": "libSDL2_image-2_0-0-2.0.5-1.14.aarch64" } }, { "category": "product_version", "name": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "product": { "name": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "product_id": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64" } }, { "category": "product_version", "name": "libSDL2_image-devel-2.0.5-1.14.aarch64", "product": { "name": "libSDL2_image-devel-2.0.5-1.14.aarch64", "product_id": "libSDL2_image-devel-2.0.5-1.14.aarch64" } }, { "category": "product_version", "name": "libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "product": { "name": "libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "product_id": "libSDL2_image-devel-32bit-2.0.5-1.14.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "product": { "name": "libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "product_id": "libSDL2_image-2_0-0-2.0.5-1.14.ppc64le" } }, { "category": "product_version", "name": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "product": { "name": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "product_id": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le" } }, { "category": "product_version", "name": "libSDL2_image-devel-2.0.5-1.14.ppc64le", "product": { "name": "libSDL2_image-devel-2.0.5-1.14.ppc64le", "product_id": "libSDL2_image-devel-2.0.5-1.14.ppc64le" } }, { "category": "product_version", "name": "libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "product": { "name": "libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "product_id": "libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "libSDL2_image-2_0-0-2.0.5-1.14.s390x", "product": { "name": "libSDL2_image-2_0-0-2.0.5-1.14.s390x", "product_id": "libSDL2_image-2_0-0-2.0.5-1.14.s390x" } }, { "category": "product_version", "name": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "product": { "name": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "product_id": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x" } }, { "category": "product_version", "name": "libSDL2_image-devel-2.0.5-1.14.s390x", "product": { "name": "libSDL2_image-devel-2.0.5-1.14.s390x", "product_id": "libSDL2_image-devel-2.0.5-1.14.s390x" } }, { "category": "product_version", "name": "libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "product": { "name": "libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "product_id": "libSDL2_image-devel-32bit-2.0.5-1.14.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "product": { "name": "libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "product_id": "libSDL2_image-2_0-0-2.0.5-1.14.x86_64" } }, { "category": "product_version", "name": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "product": { "name": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "product_id": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64" } }, { "category": "product_version", "name": "libSDL2_image-devel-2.0.5-1.14.x86_64", "product": { "name": "libSDL2_image-devel-2.0.5-1.14.x86_64", "product_id": "libSDL2_image-devel-2.0.5-1.14.x86_64" } }, { "category": "product_version", "name": "libSDL2_image-devel-32bit-2.0.5-1.14.x86_64", "product": { "name": "libSDL2_image-devel-32bit-2.0.5-1.14.x86_64", "product_id": "libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-2.0.5-1.14.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64" }, "product_reference": "libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-2.0.5-1.14.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le" }, "product_reference": "libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-2.0.5-1.14.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x" }, "product_reference": "libSDL2_image-2_0-0-2.0.5-1.14.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-2.0.5-1.14.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64" }, "product_reference": "libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64" }, "product_reference": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le" }, "product_reference": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x" }, "product_reference": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64" }, "product_reference": "libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-2.0.5-1.14.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64" }, "product_reference": "libSDL2_image-devel-2.0.5-1.14.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-2.0.5-1.14.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le" }, "product_reference": "libSDL2_image-devel-2.0.5-1.14.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-2.0.5-1.14.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x" }, "product_reference": "libSDL2_image-devel-2.0.5-1.14.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-2.0.5-1.14.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64" }, "product_reference": "libSDL2_image-devel-2.0.5-1.14.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-32bit-2.0.5-1.14.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64" }, "product_reference": "libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le" }, "product_reference": "libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-32bit-2.0.5-1.14.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x" }, "product_reference": "libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-32bit-2.0.5-1.14.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" }, "product_reference": "libSDL2_image-devel-32bit-2.0.5-1.14.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-12122", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-12122" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-12122", "url": "https://www.suse.com/security/cve/CVE-2017-12122" }, { "category": "external", "summary": "SUSE Bug 1084256 for CVE-2017-12122", "url": "https://bugzilla.suse.com/1084256" }, { "category": "external", "summary": "SUSE Bug 1084257 for CVE-2017-12122", "url": "https://bugzilla.suse.com/1084257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-12122" }, { "cve": "CVE-2017-14440", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-14440" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a stack overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-14440", "url": "https://www.suse.com/security/cve/CVE-2017-14440" }, { "category": "external", "summary": "SUSE Bug 1084256 for CVE-2017-14440", "url": "https://bugzilla.suse.com/1084256" }, { "category": "external", "summary": "SUSE Bug 1084257 for CVE-2017-14440", "url": "https://bugzilla.suse.com/1084257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-14440" }, { "cve": "CVE-2017-14441", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-14441" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2.0.2. A specially crafted ICO image can cause an integer overflow, cascading to a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-14441", "url": "https://www.suse.com/security/cve/CVE-2017-14441" }, { "category": "external", "summary": "SUSE Bug 1084256 for CVE-2017-14441", "url": "https://bugzilla.suse.com/1084256" }, { "category": "external", "summary": "SUSE Bug 1084282 for CVE-2017-14441", "url": "https://bugzilla.suse.com/1084282" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-14441" }, { "cve": "CVE-2017-14442", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-14442" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the BMP image rendering functionality of SDL2_image-2.0.2. A specially crafted BMP image can cause a stack overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-14442", "url": "https://www.suse.com/security/cve/CVE-2017-14442" }, { "category": "external", "summary": "SUSE Bug 1084256 for CVE-2017-14442", "url": "https://bugzilla.suse.com/1084256" }, { "category": "external", "summary": "SUSE Bug 1084304 for CVE-2017-14442", "url": "https://bugzilla.suse.com/1084304" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2017-14442" }, { "cve": "CVE-2017-14448", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-14448" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-14448", "url": "https://www.suse.com/security/cve/CVE-2017-14448" }, { "category": "external", "summary": "SUSE Bug 1084256 for CVE-2017-14448", "url": "https://bugzilla.suse.com/1084256" }, { "category": "external", "summary": "SUSE Bug 1084303 for CVE-2017-14448", "url": "https://bugzilla.suse.com/1084303" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-14448" }, { "cve": "CVE-2017-14449", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-14449" } ], "notes": [ { "category": "general", "text": "A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a Double-Free situation to occur. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-14449", "url": "https://www.suse.com/security/cve/CVE-2017-14449" }, { "category": "external", "summary": "SUSE Bug 1084256 for CVE-2017-14449", "url": "https://bugzilla.suse.com/1084256" }, { "category": "external", "summary": "SUSE Bug 1084297 for CVE-2017-14449", "url": "https://bugzilla.suse.com/1084297" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-14449" }, { "cve": "CVE-2017-14450", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-14450" } ], "notes": [ { "category": "general", "text": "A buffer overflow vulnerability exists in the GIF image parsing functionality of SDL2_image-2.0.2. A specially crafted GIF image can lead to a buffer overflow on a global section. An attacker can display an image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-14450", "url": "https://www.suse.com/security/cve/CVE-2017-14450" }, { "category": "external", "summary": "SUSE Bug 1084256 for CVE-2017-14450", "url": "https://bugzilla.suse.com/1084256" }, { "category": "external", "summary": "SUSE Bug 1084288 for CVE-2017-14450", "url": "https://bugzilla.suse.com/1084288" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-14450" }, { "cve": "CVE-2017-2887", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-2887" } ], "notes": [ { "category": "general", "text": "An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-2887", "url": "https://www.suse.com/security/cve/CVE-2017-2887" }, { "category": "external", "summary": "SUSE Bug 1062777 for CVE-2017-2887", "url": "https://bugzilla.suse.com/1062777" }, { "category": "external", "summary": "SUSE Bug 1062784 for CVE-2017-2887", "url": "https://bugzilla.suse.com/1062784" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2017-2887" }, { "cve": "CVE-2018-3839", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-3839" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-3839", "url": "https://www.suse.com/security/cve/CVE-2018-3839" }, { "category": "external", "summary": "SUSE Bug 1089087 for CVE-2018-3839", "url": "https://bugzilla.suse.com/1089087" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-3839" }, { "cve": "CVE-2018-3977", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-3977" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.3. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-3977", "url": "https://www.suse.com/security/cve/CVE-2018-3977" }, { "category": "external", "summary": "SUSE Bug 1114519 for CVE-2018-3977", "url": "https://bugzilla.suse.com/1114519" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2018-3977" }, { "cve": "CVE-2019-12217", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-12217" } ], "notes": [ { "category": "general", "text": "An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL stdio_read function in file/SDL_rwops.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-12217", "url": "https://www.suse.com/security/cve/CVE-2019-12217" }, { "category": "external", "summary": "SUSE Bug 1135787 for CVE-2019-12217", "url": "https://bugzilla.suse.com/1135787" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-12217" }, { "cve": "CVE-2019-12218", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-12218" } ], "notes": [ { "category": "general", "text": "An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-12218", "url": "https://www.suse.com/security/cve/CVE-2019-12218" }, { "category": "external", "summary": "SUSE Bug 1135789 for CVE-2019-12218", "url": "https://bugzilla.suse.com/1135789" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-12218" }, { "cve": "CVE-2019-12220", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-12220" } ], "notes": [ { "category": "general", "text": "An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an out-of-bounds read in the SDL function SDL_FreePalette_REAL at video/SDL_pixels.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-12220", "url": "https://www.suse.com/security/cve/CVE-2019-12220" }, { "category": "external", "summary": "SUSE Bug 1135806 for CVE-2019-12220", "url": "https://bugzilla.suse.com/1135806" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-12220" }, { "cve": "CVE-2019-12221", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-12221" } ], "notes": [ { "category": "general", "text": "An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a SEGV in the SDL function SDL_free_REAL at stdlib/SDL_malloc.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-12221", "url": "https://www.suse.com/security/cve/CVE-2019-12221" }, { "category": "external", "summary": "SUSE Bug 1135796 for CVE-2019-12221", "url": "https://bugzilla.suse.com/1135796" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-12221" }, { "cve": "CVE-2019-12222", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-12222" } ], "notes": [ { "category": "general", "text": "An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the function SDL_InvalidateMap at video/SDL_pixels.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-12222", "url": "https://www.suse.com/security/cve/CVE-2019-12222" }, { "category": "external", "summary": "SUSE Bug 1136101 for CVE-2019-12222", "url": "https://bugzilla.suse.com/1136101" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-12222" }, { "cve": "CVE-2019-13616", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-13616" } ], "notes": [ { "category": "general", "text": "SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-13616", "url": "https://www.suse.com/security/cve/CVE-2019-13616" }, { "category": "external", "summary": "SUSE Bug 1141844 for CVE-2019-13616", "url": "https://bugzilla.suse.com/1141844" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-13616" }, { "cve": "CVE-2019-5051", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5051" } ], "notes": [ { "category": "general", "text": "An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5051", "url": "https://www.suse.com/security/cve/CVE-2019-5051" }, { "category": "external", "summary": "SUSE Bug 1140419 for CVE-2019-5051", "url": "https://bugzilla.suse.com/1140419" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-5051" }, { "cve": "CVE-2019-5052", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5052" } ], "notes": [ { "category": "general", "text": "An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A specially crafted file can cause an integer overflow, resulting in too little memory being allocated, which can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5052", "url": "https://www.suse.com/security/cve/CVE-2019-5052" }, { "category": "external", "summary": "SUSE Bug 1140421 for CVE-2019-5052", "url": "https://bugzilla.suse.com/1140421" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-5052" }, { "cve": "CVE-2019-5057", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5057" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the PCX image-rendering functionality of SDL2_image 2.0.4. A specially crafted PCX image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5057", "url": "https://www.suse.com/security/cve/CVE-2019-5057" }, { "category": "external", "summary": "SUSE Bug 1143763 for CVE-2019-5057", "url": "https://bugzilla.suse.com/1143763" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-5057" }, { "cve": "CVE-2019-5058", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5058" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5058", "url": "https://www.suse.com/security/cve/CVE-2019-5058" }, { "category": "external", "summary": "SUSE Bug 1143764 for CVE-2019-5058", "url": "https://bugzilla.suse.com/1143764" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-5058" }, { "cve": "CVE-2019-5059", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5059" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow, allocating too small of a buffer. This buffer can then be written out of bounds resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5059", "url": "https://www.suse.com/security/cve/CVE-2019-5059" }, { "category": "external", "summary": "SUSE Bug 1143766 for CVE-2019-5059", "url": "https://bugzilla.suse.com/1143766" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-5059" }, { "cve": "CVE-2019-5060", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5060" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5060", "url": "https://www.suse.com/security/cve/CVE-2019-5060" }, { "category": "external", "summary": "SUSE Bug 1143768 for CVE-2019-5060", "url": "https://bugzilla.suse.com/1143768" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-2_0-0-32bit-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-2.0.5-1.14.x86_64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.aarch64", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.ppc64le", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.s390x", "openSUSE Tumbleweed:libSDL2_image-devel-32bit-2.0.5-1.14.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2019-5060" } ] }
opensuse-su-2019:2070-1
Vulnerability from csaf_opensuse
Published
2019-09-05 08:23
Modified
2019-09-05 08:23
Summary
Security update for SDL2_image
Notes
Title of the patch
Security update for SDL2_image
Description of the patch
This update for SDL2_image fixes the following issues:
Update to new upstream release 2.0.5.
Security issues fixed:
* TALOS-2019-0820 CVE-2019-5051: exploitable heap-based buffer overflow vulnerability when loading a PCX file (boo#1140419)
* TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421)
* TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763)
* TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764)
* TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image (boo#1143766)
* TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768)
Not mentioned by upstream, but issues seemingly further fixed:
* CVE-2019-12218: NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW (boo#1135789)
* CVE-2019-12217: NULL pointer dereference in the SDL stdio_read function (boo#1135787)
* CVE-2019-12220: SDL_image triggers an out-of-bounds read in the SDL function SDL_FreePalette_REAL (boo#1135806)
* CVE-2019-12221: a SEGV caused by SDL_image in SDL function SDL_free_REAL in stdlib/SDL_malloc.c (boo#1135796)
* CVE-2019-12222: out-of-bounds read triggered by SDL_image in the function SDL_InvalidateMap at video/SDL_pixels.c (boo#1136101)
* CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844).
Patchnames
openSUSE-2019-2070
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for SDL2_image", "title": "Title of the patch" }, { "category": "description", "text": "This update for SDL2_image fixes the following issues:\n\nUpdate to new upstream release 2.0.5.\n\nSecurity issues fixed:\n\n* TALOS-2019-0820 CVE-2019-5051: exploitable heap-based buffer overflow vulnerability when loading a PCX file (boo#1140419)\n* TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421)\n* TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763)\n* TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764)\n* TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image (boo#1143766)\n* TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768)\n\nNot mentioned by upstream, but issues seemingly further fixed:\n\n* CVE-2019-12218: NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW (boo#1135789)\n* CVE-2019-12217: NULL pointer dereference in the SDL stdio_read function (boo#1135787)\n* CVE-2019-12220: SDL_image triggers an out-of-bounds read in the SDL function SDL_FreePalette_REAL (boo#1135806)\n* CVE-2019-12221: a SEGV caused by SDL_image in SDL function SDL_free_REAL in stdlib/SDL_malloc.c (boo#1135796)\n* CVE-2019-12222: out-of-bounds read triggered by SDL_image in the function SDL_InvalidateMap at video/SDL_pixels.c (boo#1136101)\n* CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844).\n\n\n", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-2019-2070", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2019_2070-1.json" }, { "category": "self", "summary": "URL for openSUSE-SU-2019:2070-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/H6CP3W3YJYYFIAMX7CDOYPH65QZMBRGD/#H6CP3W3YJYYFIAMX7CDOYPH65QZMBRGD" }, { "category": "self", "summary": "E-Mail link for openSUSE-SU-2019:2070-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/H6CP3W3YJYYFIAMX7CDOYPH65QZMBRGD/#H6CP3W3YJYYFIAMX7CDOYPH65QZMBRGD" }, { "category": "self", "summary": "SUSE Bug 1135787", "url": "https://bugzilla.suse.com/1135787" }, { "category": "self", "summary": "SUSE Bug 1135789", "url": "https://bugzilla.suse.com/1135789" }, { "category": "self", "summary": "SUSE Bug 1135796", "url": "https://bugzilla.suse.com/1135796" }, { "category": "self", "summary": "SUSE Bug 1135806", "url": "https://bugzilla.suse.com/1135806" }, { "category": "self", "summary": "SUSE Bug 1136101", "url": "https://bugzilla.suse.com/1136101" }, { "category": "self", "summary": "SUSE Bug 1140419", "url": "https://bugzilla.suse.com/1140419" }, { "category": "self", "summary": "SUSE Bug 1140421", "url": "https://bugzilla.suse.com/1140421" }, { "category": "self", "summary": "SUSE Bug 1141844", "url": "https://bugzilla.suse.com/1141844" }, { "category": "self", "summary": "SUSE Bug 1143763", "url": "https://bugzilla.suse.com/1143763" }, { "category": "self", "summary": "SUSE Bug 1143764", "url": "https://bugzilla.suse.com/1143764" }, { "category": "self", "summary": "SUSE Bug 1143766", "url": "https://bugzilla.suse.com/1143766" }, { "category": "self", "summary": "SUSE Bug 1143768", "url": "https://bugzilla.suse.com/1143768" }, { "category": "self", "summary": "SUSE CVE CVE-2019-12217 page", "url": "https://www.suse.com/security/cve/CVE-2019-12217/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-12218 page", "url": "https://www.suse.com/security/cve/CVE-2019-12218/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-12220 page", "url": "https://www.suse.com/security/cve/CVE-2019-12220/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-12221 page", "url": "https://www.suse.com/security/cve/CVE-2019-12221/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-12222 page", "url": "https://www.suse.com/security/cve/CVE-2019-12222/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13616 page", "url": "https://www.suse.com/security/cve/CVE-2019-13616/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5051 page", "url": "https://www.suse.com/security/cve/CVE-2019-5051/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5052 page", "url": "https://www.suse.com/security/cve/CVE-2019-5052/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5057 page", "url": "https://www.suse.com/security/cve/CVE-2019-5057/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5058 page", "url": "https://www.suse.com/security/cve/CVE-2019-5058/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5059 page", "url": "https://www.suse.com/security/cve/CVE-2019-5059/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5060 page", "url": "https://www.suse.com/security/cve/CVE-2019-5060/" } ], "title": "Security update for SDL2_image", "tracking": { "current_release_date": "2019-09-05T08:23:48Z", "generator": { "date": "2019-09-05T08:23:48Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2019:2070-1", "initial_release_date": "2019-09-05T08:23:48Z", "revision_history": [ { "date": "2019-09-05T08:23:48Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "product": { "name": "libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "product_id": "libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586" } }, { "category": "product_version", "name": "libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "product": { "name": "libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "product_id": "libSDL2_image-devel-2.0.5-lp151.2.5.1.i586" } } ], "category": "architecture", "name": "i586" }, { "branches": [ { "category": "product_version", "name": "libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "product": { "name": "libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "product_id": "libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64" } }, { "category": "product_version", "name": "libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "product": { "name": "libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "product_id": "libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64" } }, { "category": "product_version", "name": "libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "product": { "name": "libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "product_id": "libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64" } }, { "category": "product_version", "name": "libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "product": { "name": "libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "product_id": "libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Leap 15.0", "product": { "name": "openSUSE Leap 15.0", "product_id": "openSUSE Leap 15.0", "product_identification_helper": { "cpe": "cpe:/o:opensuse:leap:15.0" } } }, { "category": "product_name", "name": "openSUSE Leap 15.1", "product": { "name": "openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1", "product_identification_helper": { "cpe": "cpe:/o:opensuse:leap:15.1" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586 as component of openSUSE Leap 15.0", "product_id": "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586" }, "product_reference": "libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "relates_to_product_reference": "openSUSE Leap 15.0" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64 as component of openSUSE Leap 15.0", "product_id": "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64" }, "product_reference": "libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.0" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64 as component of openSUSE Leap 15.0", "product_id": "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64" }, "product_reference": "libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.0" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-2.0.5-lp151.2.5.1.i586 as component of openSUSE Leap 15.0", "product_id": "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586" }, "product_reference": "libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "relates_to_product_reference": "openSUSE Leap 15.0" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64 as component of openSUSE Leap 15.0", "product_id": "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64" }, "product_reference": "libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.0" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64 as component of openSUSE Leap 15.0", "product_id": "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" }, "product_reference": "libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.0" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586" }, "product_reference": "libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64" }, "product_reference": "libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64" }, "product_reference": "libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-2.0.5-lp151.2.5.1.i586 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586" }, "product_reference": "libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64" }, "product_reference": "libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" }, "product_reference": "libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.1" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-12217", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-12217" } ], "notes": [ { "category": "general", "text": "An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL stdio_read function in file/SDL_rwops.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-12217", "url": "https://www.suse.com/security/cve/CVE-2019-12217" }, { "category": "external", "summary": "SUSE Bug 1135787 for CVE-2019-12217", "url": "https://bugzilla.suse.com/1135787" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-09-05T08:23:48Z", "details": "moderate" } ], "title": "CVE-2019-12217" }, { "cve": "CVE-2019-12218", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-12218" } ], "notes": [ { "category": "general", "text": "An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-12218", "url": "https://www.suse.com/security/cve/CVE-2019-12218" }, { "category": "external", "summary": "SUSE Bug 1135789 for CVE-2019-12218", "url": "https://bugzilla.suse.com/1135789" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-09-05T08:23:48Z", "details": "moderate" } ], "title": "CVE-2019-12218" }, { "cve": "CVE-2019-12220", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-12220" } ], "notes": [ { "category": "general", "text": "An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an out-of-bounds read in the SDL function SDL_FreePalette_REAL at video/SDL_pixels.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-12220", "url": "https://www.suse.com/security/cve/CVE-2019-12220" }, { "category": "external", "summary": "SUSE Bug 1135806 for CVE-2019-12220", "url": "https://bugzilla.suse.com/1135806" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-09-05T08:23:48Z", "details": "moderate" } ], "title": "CVE-2019-12220" }, { "cve": "CVE-2019-12221", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-12221" } ], "notes": [ { "category": "general", "text": "An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a SEGV in the SDL function SDL_free_REAL at stdlib/SDL_malloc.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-12221", "url": "https://www.suse.com/security/cve/CVE-2019-12221" }, { "category": "external", "summary": "SUSE Bug 1135796 for CVE-2019-12221", "url": "https://bugzilla.suse.com/1135796" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-09-05T08:23:48Z", "details": "moderate" } ], "title": "CVE-2019-12221" }, { "cve": "CVE-2019-12222", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-12222" } ], "notes": [ { "category": "general", "text": "An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the function SDL_InvalidateMap at video/SDL_pixels.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-12222", "url": "https://www.suse.com/security/cve/CVE-2019-12222" }, { "category": "external", "summary": "SUSE Bug 1136101 for CVE-2019-12222", "url": "https://bugzilla.suse.com/1136101" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-09-05T08:23:48Z", "details": "moderate" } ], "title": "CVE-2019-12222" }, { "cve": "CVE-2019-13616", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-13616" } ], "notes": [ { "category": "general", "text": "SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-13616", "url": "https://www.suse.com/security/cve/CVE-2019-13616" }, { "category": "external", "summary": "SUSE Bug 1141844 for CVE-2019-13616", "url": "https://bugzilla.suse.com/1141844" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-09-05T08:23:48Z", "details": "moderate" } ], "title": "CVE-2019-13616" }, { "cve": "CVE-2019-5051", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5051" } ], "notes": [ { "category": "general", "text": "An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5051", "url": "https://www.suse.com/security/cve/CVE-2019-5051" }, { "category": "external", "summary": "SUSE Bug 1140419 for CVE-2019-5051", "url": "https://bugzilla.suse.com/1140419" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-09-05T08:23:48Z", "details": "moderate" } ], "title": "CVE-2019-5051" }, { "cve": "CVE-2019-5052", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5052" } ], "notes": [ { "category": "general", "text": "An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A specially crafted file can cause an integer overflow, resulting in too little memory being allocated, which can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5052", "url": "https://www.suse.com/security/cve/CVE-2019-5052" }, { "category": "external", "summary": "SUSE Bug 1140421 for CVE-2019-5052", "url": "https://bugzilla.suse.com/1140421" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-09-05T08:23:48Z", "details": "moderate" } ], "title": "CVE-2019-5052" }, { "cve": "CVE-2019-5057", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5057" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the PCX image-rendering functionality of SDL2_image 2.0.4. A specially crafted PCX image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5057", "url": "https://www.suse.com/security/cve/CVE-2019-5057" }, { "category": "external", "summary": "SUSE Bug 1143763 for CVE-2019-5057", "url": "https://bugzilla.suse.com/1143763" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-09-05T08:23:48Z", "details": "moderate" } ], "title": "CVE-2019-5057" }, { "cve": "CVE-2019-5058", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5058" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5058", "url": "https://www.suse.com/security/cve/CVE-2019-5058" }, { "category": "external", "summary": "SUSE Bug 1143764 for CVE-2019-5058", "url": "https://bugzilla.suse.com/1143764" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-09-05T08:23:48Z", "details": "moderate" } ], "title": "CVE-2019-5058" }, { "cve": "CVE-2019-5059", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5059" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow, allocating too small of a buffer. This buffer can then be written out of bounds resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5059", "url": "https://www.suse.com/security/cve/CVE-2019-5059" }, { "category": "external", "summary": "SUSE Bug 1143766 for CVE-2019-5059", "url": "https://bugzilla.suse.com/1143766" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-09-05T08:23:48Z", "details": "moderate" } ], "title": "CVE-2019-5059" }, { "cve": "CVE-2019-5060", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-5060" } ], "notes": [ { "category": "general", "text": "An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this vulnerability.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-5060", "url": "https://www.suse.com/security/cve/CVE-2019-5060" }, { "category": "external", "summary": "SUSE Bug 1143768 for CVE-2019-5060", "url": "https://bugzilla.suse.com/1143768" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.0:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.0:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-2_0-0-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-2_0-0-32bit-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.i586", "openSUSE Leap 15.1:libSDL2_image-devel-2.0.5-lp151.2.5.1.x86_64", "openSUSE Leap 15.1:libSDL2_image-devel-32bit-2.0.5-lp151.2.5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-09-05T08:23:48Z", "details": "important" } ], "title": "CVE-2019-5060" } ] }
fkie_cve-2019-5051
Vulnerability from fkie_nvd
Published
2019-07-03 19:15
Modified
2024-11-21 04:44
Severity ?
Summary
An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.
References
▶ | URL | Tags | |
---|---|---|---|
talos-cna@cisco.com | http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html | Mailing List, Third Party Advisory | |
talos-cna@cisco.com | http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html | Mailing List, Third Party Advisory | |
talos-cna@cisco.com | https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html | Mailing List, Third Party Advisory | |
talos-cna@cisco.com | https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820 | Exploit, Third Party Advisory | |
talos-cna@cisco.com | https://usn.ubuntu.com/4238-1/ | Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html | Mailing List, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html | Mailing List, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html | Mailing List, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820 | Exploit, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://usn.ubuntu.com/4238-1/ | Third Party Advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
libsdl | sdl2_image | 2.0.4 | |
debian | debian_linux | 8.0 | |
opensuse | backports_sle | 15.0 | |
opensuse | backports_sle | 15.0 | |
opensuse | leap | 15.0 | |
opensuse | leap | 15.1 | |
canonical | ubuntu_linux | 16.04 | |
canonical | ubuntu_linux | 18.04 |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:libsdl:sdl2_image:2.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "B9FE1954-01A5-4B9A-8D4C-9DAD120C3B56", "vulnerable": true } ], "negate": false, "operator": "OR" } ] }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true } ], "negate": false, "operator": "OR" } ] }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*", "matchCriteriaId": "D83DA865-E4A6-4FBF-AA1B-A969EBA6B2AD", "vulnerable": true }, { "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*", "matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568", "vulnerable": true }, { "criteria": "cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*", "matchCriteriaId": "F1E78106-58E6-4D59-990F-75DA575BFAD9", "vulnerable": true }, { "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493", "vulnerable": true } ], "negate": false, "operator": "OR" } ] }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*", "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6", "vulnerable": true }, { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability." }, { "lang": "es", "value": "Existe una vulnerabilidad explotable de desbordamiento de b\u00fafer basado en memoria din\u00e1mica (heap) cuando se carga un archivo PCX en SDL2_image, versi\u00f3n 2.0.4. La falta de un manejador de errores puede provocar un desbordamiento del b\u00fafer y una posible ejecuci\u00f3n de c\u00f3digo. Un atacante puede proporcionar un archivo de imagen especialmente manipulado para activar esta vulnerabilidad." } ], "id": "CVE-2019-5051", "lastModified": "2024-11-21T04:44:15.193", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true } ], "cvssMetricV30": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "talos-cna@cisco.com", "type": "Secondary" } ], "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2019-07-03T19:15:12.613", "references": [ { "source": "talos-cna@cisco.com", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html" }, { "source": "talos-cna@cisco.com", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html" }, { "source": "talos-cna@cisco.com", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html" }, { "source": "talos-cna@cisco.com", "tags": [ "Exploit", "Third Party Advisory" ], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820" }, { "source": "talos-cna@cisco.com", "tags": [ "Third Party Advisory" ], "url": "https://usn.ubuntu.com/4238-1/" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory" ], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "https://usn.ubuntu.com/4238-1/" } ], "sourceIdentifier": "talos-cna@cisco.com", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-390" } ], "source": "talos-cna@cisco.com", "type": "Secondary" }, { "description": [ { "lang": "en", "value": "CWE-755" }, { "lang": "en", "value": "CWE-787" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…