Security update for SDL SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:14943-1 Final 1 1 2022-04-22T14:09:44Z current 2022-04-22T14:09:44Z 2022-04-22T14:09:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SDL This update for SDL fixes the following issues: - CVE-2020-14410: Fixed a heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c (bsc#1181201). - CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect in video/SDL_surface.c (bsc#1124825). - CVE-2021-33657: Fix a buffer overflow when parsing a crafted BMP image (bsc#1198001). - CVE-2020-14409: Fixed an integer overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SDL_blit_copy.c (bsc#1181202). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleposp3-SDL-14943,slessp4-SDL-14943 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-202214943-1/ Link for SUSE-SU-2022:14943-1 https://lists.suse.com/pipermail/sle-security-updates/2022-April/010802.html E-Mail link for SUSE-SU-2022:14943-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1124825 SUSE Bug 1124825 https://bugzilla.suse.com/1181201 SUSE Bug 1181201 https://bugzilla.suse.com/1181202 SUSE Bug 1181202 https://bugzilla.suse.com/1198001 SUSE Bug 1198001 https://www.suse.com/security/cve/CVE-2019-7637/ SUSE CVE CVE-2019-7637 page https://www.suse.com/security/cve/CVE-2020-14409/ SUSE CVE CVE-2020-14409 page https://www.suse.com/security/cve/CVE-2020-14410/ SUSE CVE CVE-2020-14410 page https://www.suse.com/security/cve/CVE-2021-33657/ SUSE CVE CVE-2021-33657 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP4-LTSS SDL-1.2.13-106.21.1 SDL-32bit-1.2.13-106.21.1 SDL-1.2.13-106.21.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 SDL-1.2.13-106.21.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS SDL-32bit-1.2.13-106.21.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in SDL_FillRect in video/SDL_surface.c. CVE-2019-7637 SUSE Linux Enterprise Point of Sale 11 SP3:SDL-1.2.13-106.21.1 SUSE Linux Enterprise Server 11 SP4-LTSS:SDL-1.2.13-106.21.1 SUSE Linux Enterprise Server 11 SP4-LTSS:SDL-32bit-1.2.13-106.21.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-202214943-1/ https://www.suse.com/security/cve/CVE-2019-7637.html CVE-2019-7637 https://bugzilla.suse.com/1124825 SUSE Bug 1124825 https://bugzilla.suse.com/1134135 SUSE Bug 1134135 SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SDL_blit_copy.c via a crafted .BMP file. CVE-2020-14409 SUSE Linux Enterprise Point of Sale 11 SP3:SDL-1.2.13-106.21.1 SUSE Linux Enterprise Server 11 SP4-LTSS:SDL-1.2.13-106.21.1 SUSE Linux Enterprise Server 11 SP4-LTSS:SDL-32bit-1.2.13-106.21.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-202214943-1/ https://www.suse.com/security/cve/CVE-2020-14409.html CVE-2020-14409 https://bugzilla.suse.com/1181202 SUSE Bug 1181202 https://bugzilla.suse.com/1200204 SUSE Bug 1200204 SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP file. CVE-2020-14410 SUSE Linux Enterprise Point of Sale 11 SP3:SDL-1.2.13-106.21.1 SUSE Linux Enterprise Server 11 SP4-LTSS:SDL-1.2.13-106.21.1 SUSE Linux Enterprise Server 11 SP4-LTSS:SDL-32bit-1.2.13-106.21.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-202214943-1/ https://www.suse.com/security/cve/CVE-2020-14410.html CVE-2020-14410 https://bugzilla.suse.com/1181201 SUSE Bug 1181201 https://bugzilla.suse.com/1200204 SUSE Bug 1200204 There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18 versions. By crafting a malicious .BMP file, an attacker can cause the application using this library to crash, denial of service or Code execution. CVE-2021-33657 SUSE Linux Enterprise Point of Sale 11 SP3:SDL-1.2.13-106.21.1 SUSE Linux Enterprise Server 11 SP4-LTSS:SDL-1.2.13-106.21.1 SUSE Linux Enterprise Server 11 SP4-LTSS:SDL-32bit-1.2.13-106.21.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-202214943-1/ https://www.suse.com/security/cve/CVE-2021-33657.html CVE-2021-33657 https://bugzilla.suse.com/1198001 SUSE Bug 1198001 https://bugzilla.suse.com/1199105 SUSE Bug 1199105 https://bugzilla.suse.com/1200204 SUSE Bug 1200204