sdl-image1.2 - Multiple Vulnerabilities
Summary
DLA-1865-1: sdl-image1.2 - security update. Affects sdl-image1.2 versions < 1.2.12-5+deb8u2. Fixed in 1.2.12-5+deb8u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sdl-image1.2 is an image file loading library that is used to load various image formats in applications. It provides functionality to decode and display images in different formats. However, multiple vulnerabilities have been discovered in the 1.x version of sdl-image1.2, which could allow remote attackers to execute arbitrary code or cause denial of service.
Vulnerability Detail
The following vulnerabilities have been identified in sdl-image1.2:
-
CVE-2018-3977: Heap buffer overflow in IMG_xcf.c. This vulnerability can be exploited by remote attackers through a crafted XCF file to execute arbitrary code or cause denial of service.
-
CVE-2019-5051: Heap-based buffer overflow in IMG_LoadPCX_RW in IMG_pcx.c. Remote attackers can leverage this vulnerability by using a specially crafted PCX file to execute arbitrary code or cause denial of service.
-
CVE-2019-5052: Integer overflow and subsequent buffer overflow in IMG_pcx.c. This vulnerability can be exploited by remote attackers through a crafted PCX file to execute arbitrary code or cause denial of service.
-
CVE-2019-7635: Heap buffer overflow affecting Blit1to4 in IMG_bmp.c. Remote attackers can exploit this vulnerability by using a specially crafted BMP file to cause denial of service or other unspecified impacts.
-
CVE-2019-12216, CVE-2019-12217, CVE-2019-12218, CVE-2019-12219, CVE-2019-12220, CVE-2019-12221, CVE-2019-12222: Multiple out-of-bound read and write accesses affecting IMG_LoadPCX_RW in IMG_pcx.c. These vulnerabilities can be exploited by remote attackers through a crafted PCX file to cause denial of service or other unspecified impacts.
How To Fix
Minimum fixed version
1.2.12-5+deb8u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sdl-image1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Multiple vulnerabilities have been discovered in sdl-image1.2, which can allow remote attackers to execute arbitrary code or cause denial of service. It is crucial to upgrade to the fixed version of sdl-image1.2 to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for sdl-image1.2 →
FAQ
sdl-image1.2 is an image file loading library used to decode and display images in various formats.
These vulnerabilities can allow remote attackers to execute arbitrary code or cause denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for open-source vulnerabilities.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to upgrade to the fixed version of sdl-image1.2.
You can find more information about these vulnerabilities in the Debian LTS security advisories and the associated CVE links provided in the vulnerability details section.
Related vulnerabilities
Recent vulnerabilities recorded for sdl-image1.2.
