CVE-2017-2888: Integer Overflow
Published Oct 11, 2017
·Updated
An exploitable integer overflow vulnerability exists when creating a new RGB Surface in SDL 2.0.5. A specially crafted file can cause an integer overflow resulting in too little memory being allocated which can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.
Affected Software
7 affected componentsFixes available
libSDL Simple DirectMedia Layer=2.0.5
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=19.04
Debian Debian Linux=9.0
debian/libsdl1.2
1.2.15+dfsg2-61.2.15+dfsg2-8
debian/libsdl2
2.0.14+dfsg2-3+deb11u12.0.14+dfsg2-3+deb11u22.26.5+dfsg-12.32.4+dfsg-12.32.10+dfsg-6
Remediation
Patch Available
Event History
Oct 11, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
DescriptionSeverityWeakness
Jan 11, 2024
Data Sourced
via Launchpad·10:36 PM
Description
Feb 19, 2026
Data Sourced
via Ubuntu·11:08 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·11:08 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2017-2888.
2
What is the severity of CVE-2017-2888?
The severity of CVE-2017-2888 is high with a CVSS score of 8.8.
3
How does the vulnerability CVE-2017-2888 occur?
The vulnerability occurs due to an integer overflow when creating a new RGB Surface in SDL 2.0.5.
4
What is the potential impact of CVE-2017-2888?
The vulnerability can lead to a buffer overflow and potential code execution.
5
Which versions of SDL are affected by CVE-2017-2888?
SDL 2.0.5 is affected by this vulnerability.