Mageia alert MGASA-2018-0454 (sdl2/mingw-SDL2)
| From: | Mageia Updates <buildsystem-daemon@mageia.org> | |
| To: | updates-announce@ml.mageia.org | |
| Subject: | [updates-announce] MGASA-2018-0454: Updated sdl2/mingw-SDL2 packages fix security vulnerabilities | |
| Date: | Sat, 17 Nov 2018 23:24:15 +0100 | |
| Message-ID: | <20181117222415.6B3CE9FEE1@duvel.mageia.org> |
MGASA-2018-0454 - Updated sdl2/mingw-SDL2 packages fix security vulnerabilities Publication date: 17 Nov 2018 URL: https://advisories.mageia.org/MGASA-2018-0454.html Type: security Affected Mageia releases: 6 CVE: CVE-2017-12122, CVE-2017-14440, CVE-2017-14441, CVE-2017-14442, CVE-2017-14448, CVE-2017-14449, CVE-2017-14450, CVE-2018-3837, CVE-2018-3838, CVE-2018-3839, CVE-2018-3977 Description: This update fixes various security vulnerabilities affecting the SDL2_image library, listed below. The fixes are provided in SDL2_image 2.0.4, which depends on SDL2 2.0.8 or later. As such, the SDL2 and SDL2_mixer libraries are also updated to their current stable releases, providing various bug fixes and features. The security vulnerabilities fixed in this update are the following: An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2017-0488, CVE-2017-12122) An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a stack overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2017-0489, CVE-2017-14440) An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2.0.2. A specially crafted ICO image can cause an integer overflow, cascading to a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2017-0490, CVE-2017-14441) An exploitable code execution vulnerability exists in the BMP image rendering functionality of SDL2_image-2.0.2. A specially crafted BMP image can cause a stack overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2017-0491, CVE-2017-14442) An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2017-0497, CVE-2017-14448) A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a Double-Free situation to occur. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2017-0498, CVE-2017-14449) A buffer overflow vulnerability exists in the GIF image parsing functionality of SDL2_image-2.0.2. A specially crafted GIF image can lead to a buffer overflow on a global section. An attacker can display an image to trigger this vulnerability. (TALOS-2017-0499, CVE-2017-14450) An exploitable information disclosure vulnerability exists in the PCX image rendering functionality of SDL2_image-2.0.2. A specially crafted PCX image can cause an out-of-bounds read on the heap, resulting in information disclosure. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2018-0519, CVE-2018-3837) An exploitable information vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds read on the heap, resulting in information disclosure. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2018-0520, CVE-2018-3838) An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2018-0521, CVE-2018-3839) An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.3. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (TALOS-2018-0645, CVE-2018-3977) References: - https://bugs.mageia.org/show_bug.cgi?id=22769 - https://talosintelligence.com/vulnerability_reports/TALOS... - https://talosintelligence.com/vulnerability_reports/TALOS... - https://talosintelligence.com/vulnerability_reports/TALOS... - https://talosintelligence.com/vulnerability_reports/TALOS... - https://talosintelligence.com/vulnerability_reports/TALOS... - https://talosintelligence.com/vulnerability_reports/TALOS... - https://talosintelligence.com/vulnerability_reports/TALOS... - https://talosintelligence.com/vulnerability_reports/TALOS... - https://talosintelligence.com/vulnerability_reports/TALOS... - https://talosintelligence.com/vulnerability_reports/TALOS... - https://talosintelligence.com/vulnerability_reports/TALOS... - https://hg.libsdl.org/SDL/file/8feb5da6f2fb/WhatsNew.txt - https://www.libsdl.org/projects/SDL_image/ - https://www.libsdl.org/projects/SDL_mixer/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3837 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3838 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3839 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3977 SRPMS: - 6/core/sdl2-2.0.9-1.mga6 - 6/core/sdl2_image-2.0.4-1.mga6 - 6/core/sdl2_mixer-2.0.4-1.mga6 - 6/core/mingw-SDL2-2.0.9-1.mga6 - 6/core/mingw-SDL2_image-2.0.4-1.mga6 - 6/core/mingw-SDL2_mixer-2.0.4-1.mga6