Security update for SDL SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:13998-1 Final 1 1 2019-03-29T15:33:20Z current 2019-03-29T15:33:20Z 2019-03-29T15:33:20Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SDL This update for SDL fixes the following issues: Security issues fixed: - CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806). - CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099). - CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799). - CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805). - CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827). - CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826). - CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824). - CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803). - CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802). - CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825). - CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-SDL-13998,sleposp3-SDL-13998,slessp4-SDL-13998 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-201913998-1/ Link for SUSE-SU-2019:13998-1 https://lists.suse.com/pipermail/sle-security-updates/2019-March/005272.html E-Mail link for SUSE-SU-2019:13998-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1124799 SUSE Bug 1124799 https://bugzilla.suse.com/1124800 SUSE Bug 1124800 https://bugzilla.suse.com/1124802 SUSE Bug 1124802 https://bugzilla.suse.com/1124803 SUSE Bug 1124803 https://bugzilla.suse.com/1124805 SUSE Bug 1124805 https://bugzilla.suse.com/1124806 SUSE Bug 1124806 https://bugzilla.suse.com/1124824 SUSE Bug 1124824 https://bugzilla.suse.com/1124825 SUSE Bug 1124825 https://bugzilla.suse.com/1124826 SUSE Bug 1124826 https://bugzilla.suse.com/1124827 SUSE Bug 1124827 https://bugzilla.suse.com/1125099 SUSE Bug 1125099 https://www.suse.com/security/cve/CVE-2019-7572/ SUSE CVE CVE-2019-7572 page https://www.suse.com/security/cve/CVE-2019-7573/ SUSE CVE CVE-2019-7573 page https://www.suse.com/security/cve/CVE-2019-7574/ SUSE CVE CVE-2019-7574 page https://www.suse.com/security/cve/CVE-2019-7575/ SUSE CVE CVE-2019-7575 page https://www.suse.com/security/cve/CVE-2019-7576/ SUSE CVE CVE-2019-7576 page https://www.suse.com/security/cve/CVE-2019-7577/ SUSE CVE CVE-2019-7577 page https://www.suse.com/security/cve/CVE-2019-7578/ SUSE CVE CVE-2019-7578 page https://www.suse.com/security/cve/CVE-2019-7635/ SUSE CVE CVE-2019-7635 page https://www.suse.com/security/cve/CVE-2019-7636/ SUSE CVE CVE-2019-7636 page https://www.suse.com/security/cve/CVE-2019-7637/ SUSE CVE CVE-2019-7637 page https://www.suse.com/security/cve/CVE-2019-7638/ SUSE CVE CVE-2019-7638 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 SDL-32bit-1.2.13-106.11.1 SDL-devel-1.2.13-106.11.1 SDL-devel-32bit-1.2.13-106.11.1 SDL-1.2.13-106.11.1 SDL-x86-1.2.13-106.11.1 SDL-1.2.13-106.11.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 SDL-1.2.13-106.11.1 as a component of SUSE Linux Enterprise Server 11 SP4 SDL-32bit-1.2.13-106.11.1 as a component of SUSE Linux Enterprise Server 11 SP4 SDL-x86-1.2.13-106.11.1 as a component of SUSE Linux Enterprise Server 11 SP4 SDL-1.2.13-106.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 SDL-32bit-1.2.13-106.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 SDL-x86-1.2.13-106.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 SDL-32bit-1.2.13-106.11.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 SDL-devel-1.2.13-106.11.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 SDL-devel-32bit-1.2.13-106.11.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c. CVE-2019-7572 SUSE Linux Enterprise Point of Sale 11 SP3:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-32bit-1.2.13-106.11.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201913998-1/ https://www.suse.com/security/cve/CVE-2019-7572.html CVE-2019-7572 https://bugzilla.suse.com/1124806 SUSE Bug 1124806 SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef loop). CVE-2019-7573 SUSE Linux Enterprise Point of Sale 11 SP3:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-32bit-1.2.13-106.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201913998-1/ https://www.suse.com/security/cve/CVE-2019-7573.html CVE-2019-7573 https://bugzilla.suse.com/1124805 SUSE Bug 1124805 SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c. CVE-2019-7574 SUSE Linux Enterprise Point of Sale 11 SP3:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-32bit-1.2.13-106.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201913998-1/ https://www.suse.com/security/cve/CVE-2019-7574.html CVE-2019-7574 https://bugzilla.suse.com/1124803 SUSE Bug 1124803 SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c. CVE-2019-7575 SUSE Linux Enterprise Point of Sale 11 SP3:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-32bit-1.2.13-106.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201913998-1/ https://www.suse.com/security/cve/CVE-2019-7575.html CVE-2019-7575 https://bugzilla.suse.com/1124802 SUSE Bug 1124802 SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop). CVE-2019-7576 SUSE Linux Enterprise Point of Sale 11 SP3:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-32bit-1.2.13-106.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201913998-1/ https://www.suse.com/security/cve/CVE-2019-7576.html CVE-2019-7576 https://bugzilla.suse.com/1124799 SUSE Bug 1124799 SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c. CVE-2019-7577 SUSE Linux Enterprise Point of Sale 11 SP3:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-32bit-1.2.13-106.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201913998-1/ https://www.suse.com/security/cve/CVE-2019-7577.html CVE-2019-7577 https://bugzilla.suse.com/1124800 SUSE Bug 1124800 SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c. CVE-2019-7578 SUSE Linux Enterprise Point of Sale 11 SP3:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-32bit-1.2.13-106.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201913998-1/ https://www.suse.com/security/cve/CVE-2019-7578.html CVE-2019-7578 https://bugzilla.suse.com/1125099 SUSE Bug 1125099 SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. CVE-2019-7635 SUSE Linux Enterprise Point of Sale 11 SP3:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-32bit-1.2.13-106.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201913998-1/ https://www.suse.com/security/cve/CVE-2019-7635.html CVE-2019-7635 https://bugzilla.suse.com/1124827 SUSE Bug 1124827 SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c. CVE-2019-7636 SUSE Linux Enterprise Point of Sale 11 SP3:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-32bit-1.2.13-106.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201913998-1/ https://www.suse.com/security/cve/CVE-2019-7636.html CVE-2019-7636 https://bugzilla.suse.com/1124826 SUSE Bug 1124826 SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in SDL_FillRect in video/SDL_surface.c. CVE-2019-7637 SUSE Linux Enterprise Point of Sale 11 SP3:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-32bit-1.2.13-106.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201913998-1/ https://www.suse.com/security/cve/CVE-2019-7637.html CVE-2019-7637 https://bugzilla.suse.com/1124825 SUSE Bug 1124825 https://bugzilla.suse.com/1134135 SUSE Bug 1134135 SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Map1toN in video/SDL_pixels.c. CVE-2019-7638 SUSE Linux Enterprise Point of Sale 11 SP3:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:SDL-x86-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-32bit-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-1.2.13-106.11.1 SUSE Linux Enterprise Software Development Kit 11 SP4:SDL-devel-32bit-1.2.13-106.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201913998-1/ https://www.suse.com/security/cve/CVE-2019-7638.html CVE-2019-7638 https://bugzilla.suse.com/1124824 SUSE Bug 1124824