CVE-2017-2888: Integer Overflow
An exploitable integer overflow vulnerability exists when creating a new RGB Surface in SDL 2.0.5. A specially crafted file can cause an integer overflow resulting in too little memory being allocated which can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libsdl1.2to a version that resolves this vulnerability.Fixed in 1.2.15+dfsg2-8 - Upgrade
Upgrade
debian/libsdl2to a version that resolves this vulnerability.Fixed in 2.26.5+dfsg-1Fixed in 2.32.4+dfsg-1Fixed in 2.32.10+dfsg-8
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2017-2888.
What is the severity of CVE-2017-2888?
The severity of CVE-2017-2888 is high with a CVSS score of 8.8.
How does the vulnerability CVE-2017-2888 occur?
The vulnerability occurs due to an integer overflow when creating a new RGB Surface in SDL 2.0.5.
What is the potential impact of CVE-2017-2888?
The vulnerability can lead to a buffer overflow and potential code execution.
Which versions of SDL are affected by CVE-2017-2888?
SDL 2.0.5 is affected by this vulnerability.