p PatchFirst

CVE-2018-3839

CVE-2018-3839

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

CVSS 7.5 · High · EPSS 2.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • simple directmedia

    Versions
    • Simple DirectMedia Layer SDL2_image 2.0.2: Affected

    No fix published

  • libsdl2-image Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.0.3+dfsg1-1

    Update to 2.0.3+dfsg1-1

  • libsdl2-image Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.0.3+dfsg1-1

    Update to 2.0.3+dfsg1-1

  • libsdl2-image Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.0.3+dfsg1-1

    Update to 2.0.3+dfsg1-1

  • sdl-image1.2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.2.12-8

    Update to 1.2.12-8

  • sdl-image1.2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.2.12-8

    Update to 1.2.12-8

  • sdl-image1.2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.2.12-8

    Update to 1.2.12-8

  • libsdl2-image Ubuntu:14.04:LTS

    Versions
    • 2.0.0+dfsg-2
    • 2.0.0+dfsg-3
    • 2.0.0+dfsg-3build2
    Affected ranges
    • ECOSYSTEM: < 2.0.0+dfsg-3+deb8u1build0.14.04.1

    Update to 2.0.0+dfsg-3+deb8u1build0.14.04.1

  • sdl-image1.2 Ubuntu:14.04:LTS

    Versions
    • 1.2.12-4ubuntu1
    • 1.2.12-5
    • 1.2.12-5build2
    Affected ranges
    • ECOSYSTEM: < 1.2.12-5+deb9u1build0.14.04.1

    Update to 1.2.12-5+deb9u1build0.14.04.1

  • libsdl2-image Ubuntu:16.04:LTS

    Versions
    • 2.0.0+dfsg-3build2
    • 2.0.1+dfsg-1
    • 2.0.1+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 2.0.1+dfsg-2+deb9u1build0.16.04.1

    Update to 2.0.1+dfsg-2+deb9u1build0.16.04.1

  • sdl-image1.2 Ubuntu:16.04:LTS

    Versions
    • 1.2.12-5build2
    Affected ranges
    • ECOSYSTEM: < 1.2.12-5+deb9u1build0.16.04.1

    Update to 1.2.12-5+deb9u1build0.16.04.1

Original sources

Check your server →