CVE-2020-14409: Integer Overflow
SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDLmemcpy heap corruption) in SDLBlitCopy in video/SDLblitcopy.c via a crafted .BMP file.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-14409?
CVE-2020-14409 is an Integer Overflow vulnerability in SDL (Simple DirectMedia Layer) through version 2.0.12, which can result in heap corruption.
How does CVE-2020-14409 affect the Simple DirectMedia Layer (SDL)?
CVE-2020-14409 affects SDL versions up to and including 2.0.12, potentially leading to heap corruption when processing a crafted .BMP file.
Which software products are affected by CVE-2020-14409?
The following software products are affected: Libsdl Simple Directmedia Layer, Fedoraproject Fedora 33, Debian Debian Linux 9.0, Starwindsoftware Starwind Virtual San (versions v8-build12533, v8-build12658, v8-build12859, v8-build13170, v8-build13586, v8-build13861).
What is the severity of CVE-2020-14409?
CVE-2020-14409 has a severity rating of 7.8 (High).
How can I fix CVE-2020-14409?
To fix CVE-2020-14409, update to a version of SDL that is not affected by the vulnerability (2.0.13 or later).