CVE-2018-3977: Buffer Overflow

Published Nov 1, 2018

Updated

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2image-2.0.3. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

Affected Software

3 affected componentsFixes available

libSDL Sdl Image=2.0.3

debian/libsdl2-image

2.0.5+dfsg1-22.6.3+dfsg-12.8.8+dfsg-1

debian/sdl-image1.2

1.2.12-121.2.12-131.2.12-14

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/libsdl2-image to a version that resolves this vulnerability.
Fixed in 2.0.5+dfsg1-2Fixed in 2.6.3+dfsg-1Fixed in 2.8.8+dfsg-1
Upgrade
Upgrade debian/sdl-image1.2 to a version that resolves this vulnerability.
Fixed in 1.2.12-12Fixed in 1.2.12-13Fixed in 1.2.12-14

Event History

Nov 1, 2018

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2018-3977?

CVE-2018-3977 is an exploitable code execution vulnerability in the XCF image rendering functionality of SDL2_image-2.0.3.

How does CVE-2018-3977 work?

A specially crafted XCF image can cause a heap overflow, resulting in code execution.

What is the severity of CVE-2018-3977?

CVE-2018-3977 has a severity value of 8.8 (high).

Which software versions are affected by CVE-2018-3977?

SDL2_image-2.0.0+dfsg-3+ up to exclusive SDL2_image-2.0.3+dfsg1-3 are affected.

How can I fix CVE-2018-3977?

To fix CVE-2018-3977, upgrade to SDL2_image version 2.0.0+dfsg-3+ (for Ubuntu) or version 2.0.4+dfsg1-1+deb10u1 (for Debian).