CVE-2017-14449: Double Free
A double-Free vulnerability exists in the XCF image rendering functionality of SDL2image-2.0.2. A specially crafted XCF image can cause a Double-Free situation to occur. An attacker can display a specially crafted image to trigger this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libsdl2-imageto a version that resolves this vulnerability.Fixed in 2.0.4+dfsg1-1+deb10u1Fixed in 2.0.5+dfsg1-2Fixed in 2.6.3+dfsg-1Fixed in 2.6.3+dfsg-2 - Upgrade
Upgrade
debian/sdl-image1.2to a version that resolves this vulnerability.Fixed in 1.2.12-10+deb10u1Fixed in 1.2.12-12Fixed in 1.2.12-13 - Upgrade
Upgrade
alpine/sdl2_imageto a version that resolves this vulnerability.Fixed in 2.0.3-r0
Event History
Frequently Asked Questions
What is CVE-2017-14449?
CVE-2017-14449 is a double-Free vulnerability in the XCF image rendering functionality of SDL2_image-2.0.2.
How does CVE-2017-14449 impact the affected software?
CVE-2017-14449 can cause a Double-Free situation to occur when a specially crafted XCF image is displayed.
What is the severity of CVE-2017-14449?
The severity of CVE-2017-14449 is rated as high with a CVSS score of 8.8.
How can I fix CVE-2017-14449 on Debian Linux?
To fix CVE-2017-14449 on Debian Linux, update the libsdl2-image package to version 2.0.4+dfsg1-1+deb10u1 or later.
Where can I find more information about CVE-2017-14449?
You can find more information about CVE-2017-14449 at the following references: [Gentoo Security Advisory GLSA 201903-17](https://security.gentoo.org/glsa/201903-17), [Debian Security Advisory DSA-4177](https://www.debian.org/security/2018/dsa-4177), [Talos Intelligence Vulnerability Report TALOS-2017-0498](https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0498).