USN-4143-1: SDL 2.0 vulnerabilities
It was discovered that SDL 2.0 mishandled crafted image files resulting in an integer overflow. If a user were tricked into opening a malicious file, SDL 2.0 could be caused to crash or potentially run arbitrary code. (CVE-2017-2888) It was discovered that SDL 2.0 mishandled crafted image files. If a user were tricked into opening a malicious file, SDL 2.0 could be caused to crash or potentially run arbitrary code. (CVE-2019-7635, CVE-2019-7636, CVE-2019-7637, CVE-2019-7638)
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID for this SDL 2.0 vulnerability?
The vulnerability ID for this SDL 2.0 vulnerability is CVE-2017-2888.
How does the SDL 2.0 vulnerability occur?
The SDL 2.0 vulnerability occurs when crafted image files are mishandled, leading to an integer overflow.
What is the potential impact of the SDL 2.0 vulnerability?
If a user opens a malicious file, the SDL 2.0 vulnerability can cause a crash or potentially allow arbitrary code execution.
Which versions of SDL 2.0 are affected by this vulnerability?
The versions affected by this vulnerability include SDL 2.0.4+dfsg1-2ubuntu2.16.04.2, SDL 2.0.8+dfsg1-1ubuntu1.18.04.4, and SDL 2.0.9+dfsg1-1ubuntu1.19.04.1.
How can I fix the SDL 2.0 vulnerability?
To fix the SDL 2.0 vulnerability, update your SDL 2.0 package to a version that includes the fix, such as SDL 2.0.9+dfsg1-1ubuntu1.19.04.1, SDL 2.0.8+dfsg1-1ubuntu1.18.04.4, or SDL 2.0.4+dfsg1-2ubuntu2.16.04.2.