Security update for SDL_image SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:3657-1 Final 1 1 2018-11-07T15:19:23Z current 2018-11-07T15:19:23Z 2018-11-07T15:19:23Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SDL_image This update for SDL_image fixes the following issues: - CVE-2017-14442: A specially crafted BMP image could have caused a stack overflow for an attacker that can display a specially crafted image (bsc#1084304). - CVE-2017-14450: A specially crafted GIF image could have caused a buffer overflow on a global section for an attacker that can display an image (bsc#1084288). - CVE-2017-12122: An exploitable code execution vulnerability exists in the ILBM image rendering functionality. A specially crafted ILBM image can cause a heap overflow resulting in code execution. (bsc#1084256). - CVE-2017-14440: An exploitable code execution vulnerability exists in the ILBM image rendering functionality. A specially crafted ILBM image can cause a stack overflow resulting in code execution. (bsc#1084257). - CVE-2017-14448: An exploitable code execution vulnerability exists in the XCF image rendering functionality. A specially crafted XCF image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (bsc#1084303). - CVE-2018-3839: An exploitable code execution vulnerability exists in the XCF image rendering functionality. A specially crafted XCF image can cause an out-of-bounds write on the heap, resulting in code execution. (bsc#1089087). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-SDL_image-13859 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20183657-1/ Link for SUSE-SU-2018:3657-1 https://lists.suse.com/pipermail/sle-security-updates/2018-November/004836.html E-Mail link for SUSE-SU-2018:3657-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1084256 SUSE Bug 1084256 https://bugzilla.suse.com/1084257 SUSE Bug 1084257 https://bugzilla.suse.com/1084288 SUSE Bug 1084288 https://bugzilla.suse.com/1084303 SUSE Bug 1084303 https://bugzilla.suse.com/1084304 SUSE Bug 1084304 https://bugzilla.suse.com/1089087 SUSE Bug 1089087 https://www.suse.com/security/cve/CVE-2017-12122/ SUSE CVE CVE-2017-12122 page https://www.suse.com/security/cve/CVE-2017-14440/ SUSE CVE CVE-2017-14440 page https://www.suse.com/security/cve/CVE-2017-14442/ SUSE CVE CVE-2017-14442 page https://www.suse.com/security/cve/CVE-2017-14448/ SUSE CVE CVE-2017-14448 page https://www.suse.com/security/cve/CVE-2017-14450/ SUSE CVE CVE-2017-14450 page https://www.suse.com/security/cve/CVE-2018-3839/ SUSE CVE CVE-2018-3839 page SUSE Linux Enterprise Software Development Kit 11 SP4 SDL_image-1.2.6-84.42.1 SDL_image-devel-1.2.6-84.42.1 SDL_image-1.2.6-84.42.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 SDL_image-devel-1.2.6-84.42.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. CVE-2017-12122 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL_image-1.2.6-84.42.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL_image-devel-1.2.6-84.42.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183657-1/ https://www.suse.com/security/cve/CVE-2017-12122.html CVE-2017-12122 https://bugzilla.suse.com/1084256 SUSE Bug 1084256 https://bugzilla.suse.com/1084257 SUSE Bug 1084257 An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a stack overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. CVE-2017-14440 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL_image-1.2.6-84.42.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL_image-devel-1.2.6-84.42.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183657-1/ https://www.suse.com/security/cve/CVE-2017-14440.html CVE-2017-14440 https://bugzilla.suse.com/1084256 SUSE Bug 1084256 https://bugzilla.suse.com/1084257 SUSE Bug 1084257 An exploitable code execution vulnerability exists in the BMP image rendering functionality of SDL2_image-2.0.2. A specially crafted BMP image can cause a stack overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. CVE-2017-14442 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL_image-1.2.6-84.42.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL_image-devel-1.2.6-84.42.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183657-1/ https://www.suse.com/security/cve/CVE-2017-14442.html CVE-2017-14442 https://bugzilla.suse.com/1084256 SUSE Bug 1084256 https://bugzilla.suse.com/1084304 SUSE Bug 1084304 An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. CVE-2017-14448 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL_image-1.2.6-84.42.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL_image-devel-1.2.6-84.42.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183657-1/ https://www.suse.com/security/cve/CVE-2017-14448.html CVE-2017-14448 https://bugzilla.suse.com/1084256 SUSE Bug 1084256 https://bugzilla.suse.com/1084303 SUSE Bug 1084303 A buffer overflow vulnerability exists in the GIF image parsing functionality of SDL2_image-2.0.2. A specially crafted GIF image can lead to a buffer overflow on a global section. An attacker can display an image to trigger this vulnerability. CVE-2017-14450 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL_image-1.2.6-84.42.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL_image-devel-1.2.6-84.42.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183657-1/ https://www.suse.com/security/cve/CVE-2017-14450.html CVE-2017-14450 https://bugzilla.suse.com/1084256 SUSE Bug 1084256 https://bugzilla.suse.com/1084288 SUSE Bug 1084288 An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. CVE-2018-3839 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL_image-1.2.6-84.42.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL_image-devel-1.2.6-84.42.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183657-1/ https://www.suse.com/security/cve/CVE-2018-3839.html CVE-2018-3839 https://bugzilla.suse.com/1089087 SUSE Bug 1089087