CVE-2022-27470: High severity libSDL Sdl Ttf vulnerability
SDLttf v2.0.18 and below was discovered to contain an arbitrary memory write via the function TTFRenderTextSolid(). This vulnerability is triggered via a crafted TTF file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libsdl2-ttfto a version that resolves this vulnerability.Fixed in 2.20.1+dfsg-2Fixed in 2.24.0+dfsg-2Fixed in 2.24.0+dfsg-3 - Upgrade
Upgrade
alpine/sdl2_ttfto a version that resolves this vulnerability.Fixed in 2.20.0-r0 - Upgrade
Upgrade
debian/libsdl2-ttfto a version that resolves this vulnerability.Fixed in 2.0.18+dfsg-3
Event History
Frequently Asked Questions
What is CVE-2022-27470?
CVE-2022-27470 refers to a vulnerability in SDL_ttf v2.0.18 and below that allows for arbitrary memory write via the function TTF_RenderText_Solid().
How can the CVE-2022-27470 vulnerability be triggered?
The CVE-2022-27470 vulnerability is triggered through a crafted TTF file.
What is the severity of CVE-2022-27470?
CVE-2022-27470 has a severity rating of 7.8 out of 10 (high severity).
Which software versions are affected by CVE-2022-27470?
SDL_ttf v2.0.18 and below, Libsdl Sdl Ttf, Fedora 34, Fedora 35, and Fedora 36.
How can I fix CVE-2022-27470?
To fix CVE-2022-27470, it is recommended to update to a version of SDL_ttf that is above v2.0.18.