CVE-2017-14441: Integer Overflow
An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2image-2.0.2. A specially crafted ICO image can cause an integer overflow, cascading to a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libsdl2-imageto a version that resolves this vulnerability.Fixed in 2.0.4+dfsg1-1+deb10u1Fixed in 2.0.5+dfsg1-2Fixed in 2.6.3+dfsg-1Fixed in 2.6.3+dfsg-2 - Upgrade
Upgrade
debian/sdl-image1.2to a version that resolves this vulnerability.Fixed in 1.2.12-10+deb10u1Fixed in 1.2.12-12Fixed in 1.2.12-13 - Upgrade
Upgrade
alpine/sdl2_imageto a version that resolves this vulnerability.Fixed in 2.0.3-r0 - Upgrade
Upgrade
alpine/sdl2_imageto a version that resolves this vulnerability.Fixed in 2.0.1-r2 - Upgrade
Upgrade
alpine/sdl2_imageto a version that resolves this vulnerability.Fixed in 2.0.2-r1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14441?
The severity of CVE-2017-14441 is high with a score of 8.8.
How does the vulnerability in CVE-2017-14441 work?
The vulnerability in CVE-2017-14441 allows an attacker to execute code by exploiting an integer overflow and resulting heap overflow in the ICO image rendering functionality of SDL2_image-2.0.2.
Which software versions are affected by CVE-2017-14441?
The software versions affected by CVE-2017-14441 include libsdl2-image 2.0.2 and sdl-image1.2 1.2.12.
How can I fix CVE-2017-14441?
To fix CVE-2017-14441, update to the latest versions of libsdl2-image or sdl-image1.2 as specified in the Debian security advisories.
Where can I find more information about CVE-2017-14441?
You can find more information about CVE-2017-14441 in the Debian security advisories and the Gentoo security advisory. Links are provided in the references section.