[gentoo-announce] [ GLSA 201903-17 ] SDL2_Image: Multiple vulnerabilities

[Aaron Bauman <bman@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 3564 bytes --]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 201903-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                           https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal
    Title: SDL2_Image: Multiple vulnerabilities
     Date: March 28, 2019
     Bugs: #655226, #674132
       ID: 201903-17

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been found in the image loading library
for Simple DirectMedia Layer, the worst of which could result in the
remote execution of arbitrary code.

Background
==========

SDL_image is an image file library that loads images as SDL surfaces,
and supports various formats like BMP, GIF, JPEG, LBM, PCX, PNG, PNM,
TGA, TIFF, XCF, XPM, and XV.

Affected packages
=================

    -------------------------------------------------------------------
     Package              /     Vulnerable     /            Unaffected
    -------------------------------------------------------------------
  1  media-libs/sdl2-image        < 2.0.4                    >= 2.0.4 

Description
===========

Multiple vulnerabilities have been discovered in SDL2_Image. Please
review the CVE identifiers referenced below for details.

Impact
======

A remote attacker, by enticing a user to process a specially crafted
image file, could execute arbitrary code, cause a Denial of Service
condition, or obtain sensitive information.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All SDL2_Image users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=media-libs/sdl2-image-2.0.4"

References
==========

[  1 ] CVE-2017-12122
       https://nvd.nist.gov/vuln/detail/CVE-2017-12122
[  2 ] CVE-2017-14440
       https://nvd.nist.gov/vuln/detail/CVE-2017-14440
[  3 ] CVE-2017-14441
       https://nvd.nist.gov/vuln/detail/CVE-2017-14441
[  4 ] CVE-2017-14442
       https://nvd.nist.gov/vuln/detail/CVE-2017-14442
[  5 ] CVE-2017-14448
       https://nvd.nist.gov/vuln/detail/CVE-2017-14448
[  6 ] CVE-2017-14449
       https://nvd.nist.gov/vuln/detail/CVE-2017-14449
[  7 ] CVE-2017-14450
       https://nvd.nist.gov/vuln/detail/CVE-2017-14450
[  8 ] CVE-2018-3837
       https://nvd.nist.gov/vuln/detail/CVE-2018-3837
[  9 ] CVE-2018-3838
       https://nvd.nist.gov/vuln/detail/CVE-2018-3838
[ 10 ] CVE-2018-3839
       https://nvd.nist.gov/vuln/detail/CVE-2018-3839
[ 11 ] CVE-2018-3977
       https://nvd.nist.gov/vuln/detail/CVE-2018-3977

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 https://security.gentoo.org/glsa/201903-17

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2019 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]