CVEvulnerability

CVE-2019-14906

9.8 CRITICAL Published 2020-01-07 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-01-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-125, CWE-787

Description

A flaw was found with the RHSA-2019:3950 erratum, where it did not fix the CVE-2019-13616 SDL vulnerability. This issue only affects Red Hat SDL packages, SDL versions through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow flaw while copying an existing surface into a new optimized one, due to a lack of validation while loading a BMP image, is possible. An application that uses SDL to parse untrusted input files may be vulnerable to this flaw, which could allow an attacker to make the application crash or execute code.

Affected configurations

• libsdl simple directmedia layer (<= 1.2.15) • libsdl simple directmedia layer (>= 2.0.0 <= 2.0.9) • redhat enterprise linux 7.0

Related

Weakness · CWE (2)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-787 Out-of-bounds Write weakness

References