Heap-Based Buffer Over-Read in SDL Package - CVE-2019-7638
Summary
ALPINE-CVE-2019-7638: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Map1toN in video/SDL_pixels.c. Affects sdl versions < 1.2.15-r11. Fixed in 1.2.15-r11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The SDL (Simple DirectMedia Layer) is a cross-platform development library designed to provide low-level access to audio, keyboard, mouse, joystick, and graphics hardware via OpenGL and Direct3D. It is widely used in game development and multimedia applications due to its efficiency and flexibility. However, vulnerabilities in SDL can lead to severe security risks, particularly in versions prior to 1.2.15 and 2.x prior to 2.0.10, which are susceptible to heap-based buffer over-reads.
Vulnerability Detail
The vulnerability identified as CVE-2019-7638 is a heap-based buffer over-read found in the Map1toN function within the SDL library's video/SDL_pixels.c file. This flaw can allow attackers to read sensitive data from memory, potentially leading to information disclosure or application crashes. The vulnerability arises from improper handling of memory, which can be exploited if an attacker can manipulate the input to the affected function. The CVSS score for this vulnerability is 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
1.2.15-r11
This is the first release that contains the fix.
sudo apk add --upgrade sdlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the affected application or disabling features that utilize the vulnerable SDL functions until an update can be applied. This may involve modifying application configurations or using alternative libraries.
Conclusion
CVE-2019-7638 is a significant vulnerability affecting the SDL library, with potential ramifications for applications relying on this library. It is crucial to update to the patched versions to mitigate risks associated with this vulnerability. Users are encouraged to utilize tools like Vulert to monitor their applications for vulnerabilities effectively.
See every vulnerability recorded for sdl →
FAQ
CVE-2019-7638 is a vulnerability in the SDL library that allows for a heap-based buffer over-read, potentially leading to information disclosure.
Versions of SDL prior to 1.2.15 and SDL2 prior to 2.0.10 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by analyzing your manifest file.
If immediate updates are not possible, consider implementing workarounds such as restricting access to the application or disabling vulnerable features.
The CVSS score for CVE-2019-7638 is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for sdl.
