CVE-2019-12216: Buffer Overflow

Published May 20, 2019

Updated

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2image.a in SDL2image 2.0.4. There is a heap-based buffer overflow in the SDL2image function IMGLoadPCXRW at IMGpcx.c.

Affected Software

9 affected componentsFixes available

debian/libsdl2-image

2.0.5+dfsg1-22.6.3+dfsg-12.8.8+dfsg-1

debian/sdl-image1.2

1.2.12-121.2.12-131.2.12-14

All of the following

libSDL Sdl2 Image=2.0.4

libSDL Simple DirectMedia Layer=2.0.9

Fedoraproject Fedora=29

Fedoraproject Fedora=31

Debian Debian Linux=8.0

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=18.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/libsdl2-image to a version that resolves this vulnerability.
Fixed in 2.0.5+dfsg1-2Fixed in 2.6.3+dfsg-1Fixed in 2.8.8+dfsg-1
Upgrade
Upgrade debian/sdl-image1.2 to a version that resolves this vulnerability.
Fixed in 1.2.12-12Fixed in 1.2.12-13Fixed in 1.2.12-14

Event History

May 20, 2019

CVE Published

via MITRE·04:32 PM

Data Sourced

via MITRE·04:32 PM

Description

Frequently Asked Questions

What is CVE-2019-12216?

CVE-2019-12216 is a vulnerability in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4.

What is the severity of CVE-2019-12216?

The severity of CVE-2019-12216 is medium with a CVSS score of 6.5.

How does CVE-2019-12216 affect the software?

CVE-2019-12216 affects libSDL2.a in SDL 2.0.9 and libSDL2_image.a in SDL2_image 2.0.4.

How can I fix CVE-2019-12216?

To fix CVE-2019-12216, update the affected software to the specified versions or apply the recommended remedies.

Where can I find more information about CVE-2019-12216?

You can find more information about CVE-2019-12216 on the CVE Mitre website, the SDL bugzilla, and the Ubuntu security notices.