CVE-2018-3977: Buffer Overflow
Published Nov 1, 2018
·Updated
An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2image-2.0.3. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.
Affected Software
3 affected componentsFixes available
libSDL Sdl Image=2.0.3
debian/libsdl2-image
2.0.5+dfsg1-22.6.3+dfsg-12.8.8+dfsg-1
debian/sdl-image1.2
1.2.12-121.2.12-131.2.12-14
Event History
Nov 1, 2018
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
DescriptionSeverityWeakness
Jan 11, 2024
Data Sourced
via Launchpad·11:02 PM
Description
Sep 16, 2024
Data Sourced
via Ubuntu·02:04 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is CVE-2018-3977?
CVE-2018-3977 is an exploitable code execution vulnerability in the XCF image rendering functionality of SDL2_image-2.0.3.
2
How does CVE-2018-3977 work?
A specially crafted XCF image can cause a heap overflow, resulting in code execution.
3
What is the severity of CVE-2018-3977?
CVE-2018-3977 has a severity value of 8.8 (high).
4
Which software versions are affected by CVE-2018-3977?
SDL2_image-2.0.0+dfsg-3+ up to exclusive SDL2_image-2.0.3+dfsg1-3 are affected.
5
How can I fix CVE-2018-3977?
To fix CVE-2018-3977, upgrade to SDL2_image version 2.0.0+dfsg-3+ (for Ubuntu) or version 2.0.4+dfsg1-1+deb10u1 (for Debian).