CVE-2019-13616: High severity libSDL Simple DirectMedia Layer vulnerability
Last updated 18 August 2025
Other sources
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDLblitN.c when called from SDLSoftBlit in video/SDLblit.c.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libsdl1.2to a version that resolves this vulnerability.Fixed in 1.2.15+dfsg2-6Fixed in 1.2.15+dfsg2-8 - Upgrade
Upgrade
debian/libsdl2to a version that resolves this vulnerability.Fixed in 2.0.14+dfsg2-3+deb11u1Fixed in 2.0.14+dfsg2-3+deb11u2Fixed in 2.26.5+dfsg-1Fixed in 2.32.4+dfsg-1Fixed in 2.32.10+dfsg-6 - Upgrade
Upgrade
debian/libsdl2-imageto a version that resolves this vulnerability.Fixed in 2.0.5+dfsg1-2Fixed in 2.6.3+dfsg-1Fixed in 2.8.8+dfsg-1Fixed in 2.8.8+dfsg-2 - Upgrade
Upgrade
debian/sdl-image1.2to a version that resolves this vulnerability.Fixed in 1.2.12-12Fixed in 1.2.12-13Fixed in 1.2.12-14 - Upgrade
Upgrade
alpine/sdlto a version that resolves this vulnerability.Fixed in 1.2.15-r12 - Upgrade
Upgrade
alpine/sdlto a version that resolves this vulnerability.Fixed in 1.2.15-r9 - Upgrade
Upgrade
alpine/sdlto a version that resolves this vulnerability.Fixed in 1.2.15-r10 - Upgrade
Upgrade
alpine/sdlto a version that resolves this vulnerability.Fixed in 1.2.15-r11 - Upgrade
Upgrade
alpine/sdl2_imageto a version that resolves this vulnerability.Fixed in 2.0.5-r1 - Upgrade
Upgrade
alpine/sdl_imageto a version that resolves this vulnerability.Fixed in 1.2.12-r5 - Upgrade
Upgrade
alpine/sdl_imageto a version that resolves this vulnerability.Fixed in 1.2.12-r4
Event History
Frequently Asked Questions
What is CVE-2019-13616?
CVE-2019-13616 is a vulnerability in SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 that allows a heap-based buffer over-read.
What is the severity of CVE-2019-13616?
The severity of CVE-2019-13616 is high, with a severity value of 8.1.
Which software versions are affected by CVE-2019-13616?
SDL versions through 1.2.15 and 2.x through 2.0.9 are affected by CVE-2019-13616.
How can I fix CVE-2019-13616?
To fix CVE-2019-13616, it is recommended to update SDL to version 1.2.12-5+ or higher.
Where can I find more information about CVE-2019-13616?
More information about CVE-2019-13616 can be found at the following references: [1](https://bugzilla.libsdl.org/show_bug.cgi?id=4538), [2](http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html), [3](http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html).