CVE-2017-14442: Buffer Overflow
An exploitable code execution vulnerability exists in the BMP image rendering functionality of SDL2image-2.0.2. A specially crafted BMP image can cause a stack overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libsdl2-imageto a version that resolves this vulnerability.Fixed in 2.0.4+dfsg1-1+deb10u1Fixed in 2.0.5+dfsg1-2Fixed in 2.6.3+dfsg-1Fixed in 2.6.3+dfsg-2 - Upgrade
Upgrade
debian/sdl-image1.2to a version that resolves this vulnerability.Fixed in 1.2.12-10+deb10u1Fixed in 1.2.12-12Fixed in 1.2.12-13 - Upgrade
Upgrade
alpine/sdl2_imageto a version that resolves this vulnerability.Fixed in 2.0.3-r0 - Upgrade
Upgrade
alpine/sdl2_imageto a version that resolves this vulnerability.Fixed in 2.0.1-r2 - Upgrade
Upgrade
alpine/sdl2_imageto a version that resolves this vulnerability.Fixed in 2.0.2-r1
Event History
Frequently Asked Questions
What is CVE-2017-14442?
CVE-2017-14442 is a code execution vulnerability in the BMP image rendering functionality of SDL2_image-2.0.2.
How does CVE-2017-14442 work?
This vulnerability can be triggered by a specially crafted BMP image, causing a stack overflow and leading to code execution.
What is the severity of CVE-2017-14442?
CVE-2017-14442 has a severity value of 8.8, indicating a high severity.
How can I fix CVE-2017-14442?
To fix CVE-2017-14442, update to one of the following versions: libsdl2-image 2.0.4+dfsg1-1+deb10u1, 2.0.5+dfsg1-2, 2.6.3+dfsg-1, or 2.6.3+dfsg-2.
Where can I find more information about CVE-2017-14442?
You can find more information about CVE-2017-14442 at the following references: [1](https://lists.debian.org/debian-lts-announce/2018/04/msg00005.html), [2](https://security.gentoo.org/glsa/201903-17), [3](https://www.debian.org/security/2018/dsa-4177).