Every CVE Search/ Get API key

CVE-2019-5058

An exploitable code execution vulnerability exists in the XCF image rendering functionality of...

8.8 HighFix available

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.62%Up 1.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 8.8

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

Record
CVE-2019-5058
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2019-14665 8.8

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

Record
EUVD-2019-14665
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-g3fv-2w8r-wh3m 8.8

An exploitable code execution vulnerability exists in the XCF image rendering functionality of...

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

Record
GHSA-g3fv-2w8r-wh3m
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 8.8

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

Record
CVE-2019-5058
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-122, CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2019-5058 8.8

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

Record
ALPINE-CVE-2019-5058
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.8

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

Record
CVE-2019-5058
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2019-5058 8.8

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

Record
DEBIAN-CVE-2019-5058
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-5058 8.8

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

Record
UBUNTU-CVE-2019-5058
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2019-0363 No score

Updated SDL_image packages fix security vulnerabilities

The updated packages fix security vulnerabilities:

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.3. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (CVE-2018-3977)

An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A specially crafted file can cause an integer overflow, resulting in too little memory being allocated, which can lead to a buffer overflow and potential code execution. (CVE-2019-5052)

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. (CVE-2019-5058)

An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow, allocating too small of a buffer. This buffer can then be written out of bounds resulting in a heap overflow, ultimately ending in code execution. (CVE-2019-5059)

An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. (CVE-2019-5060)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (CVE-2019-7635).

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL stdio_read function in file/SDL_rwops.c. (CVE-2019-12217)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c. (CVE-2019-12218)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an invalid free error in the SDL function SDL_SetError_REAL at SDL_error.c. (CVE-2019-12219)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an out-of-bounds read in the SDL function SDL_FreePalette_REAL at video/SDL_pixels.c. (CVE-2019-12220)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a SEGV in the SDL function SDL_free_REAL at stdlib/SDL_malloc.c. (CVE-2019-12221)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the function SDL_InvalidateMap at video/SDL_pixels.c. (CVE-2019-12222)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c. (CVE-2019-13616)

Record
MGASA-2019-0363
Updated
2026-11-02
OSVMGASA-2019-0364 No score

Updated sdl2_image packages fix security vulnerabilities

Updated sdl2_image packages fix security vulnerabilities:

An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability. (CVE-2019-5051)

An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A specially crafted file can cause an integer overflow, resulting in too little memory being allocated, which can lead to a buffer overflow and potential code execution. (CVE-2019-5052)

An exploitable code execution vulnerability exists in the PCX image rendering functionality of SDL2_image 2.0.4. A specially crafted PCX image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (CVE-2019-5057)

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. (CVE-2019-5058)

An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow, allocating too small of a buffer. This buffer can then be written out of bounds resulting in a heap overflow, ultimately ending in code execution. (CVE-2019-5059)

An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. (CVE-2019-5060)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL stdio_read function in file/SDL_rwops.c. (CVE-2019-12217)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c. (CVE-2019-12218)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an invalid free error in the SDL function SDL_SetError_REAL at SDL_error.c. (CVE-2019-12219)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an out-of-bounds read in the SDL function SDL_FreePalette_REAL at video/SDL_pixels.c. (CVE-2019-12220)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a SEGV in the SDL function SDL_free_REAL at stdlib/SDL_malloc.c. (CVE-2019-12221)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the function SDL_InvalidateMap at video/SDL_pixels.c. (CVE-2019-12222)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c. (CVE-2019-13616)

Record
MGASA-2019-0364
Updated
2026-11-02
OSVopenSUSE-SU-2019:2070-1 No score

Security update for SDL2_image

This update for SDL2_image fixes the following issues:

Update to new upstream release 2.0.5.

Security issues fixed:

  • TALOS-2019-0820 CVE-2019-5051: exploitable heap-based buffer overflow vulnerability when loading a PCX file (boo#1140419)
  • TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421)
  • TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763)
  • TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764)
  • TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image (boo#1143766)
  • TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768)

Not mentioned by upstream, but issues seemingly further fixed:

  • CVE-2019-12218: NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW (boo#1135789)
  • CVE-2019-12217: NULL pointer dereference in the SDL stdio_read function (boo#1135787)
  • CVE-2019-12220: SDL_image triggers an out-of-bounds read in the SDL function SDL_FreePalette_REAL (boo#1135806)
  • CVE-2019-12221: a SEGV caused by SDL_image in SDL function SDL_free_REAL in stdlib/SDL_malloc.c (boo#1135796)
  • CVE-2019-12222: out-of-bounds read triggered by SDL_image in the function SDL_InvalidateMap at video/SDL_pixels.c (boo#1136101)
  • CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844).
Record
openSUSE-SU-2019:2070-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2071-1 No score

Security update for SDL_image

This update for SDL_image fixes the following issues:

Update SDL_Image to new snapshot 1.2.12+hg695.

Security issues fixed:

  • TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421)
  • TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763)
  • TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764)
  • TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image handling (boo#1143766)
  • TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768)
  • CVE-2019-7635: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (boo#1124827)
  • CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844).
Record
openSUSE-SU-2019:2071-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2108-1 No score

Security update for SDL2_image

This update for SDL2_image fixes the following issues:

Update to new upstream release 2.0.5.

Security issues fixed:

  • TALOS-2019-0820 CVE-2019-5051: exploitable heap-based buffer overflow vulnerability when loading a PCX file (boo#1140419)
  • TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421)
  • TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763)
  • TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764)
  • TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image (boo#1143766)
  • TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768)

Not mentioned by upstream, but issues seemingly further fixed:

  • CVE-2019-12218: NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW (boo#1135789)
  • CVE-2019-12217: NULL pointer dereference in the SDL stdio_read function (boo#1135787)
  • CVE-2019-12220: SDL_image triggers an out-of-bounds read in the SDL function SDL_FreePalette_REAL (boo#1135806)
  • CVE-2019-12221: a SEGV caused by SDL_image in SDL function SDL_free_REAL in stdlib/SDL_malloc.c (boo#1135796)
  • CVE-2019-12222: out-of-bounds read triggered by SDL_image in the function SDL_InvalidateMap at video/SDL_pixels.c (boo#1136101)
  • CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844).

This update was imported from the openSUSE:Leap:15.0:Update update project.

Record
openSUSE-SU-2019:2108-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2109-1 No score

Security update for SDL_image

This update for SDL_image fixes the following issues:

Update SDL_Image to new snapshot 1.2.12+hg695.

Security issues fixed:

  • TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421)
  • TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763)
  • TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764)
  • TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image handling (boo#1143766)
  • TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768)
  • CVE-2019-7635: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (boo#1124827)
  • CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844).

This update was imported from the openSUSE:Leap:15.0:Update update project.

Record
openSUSE-SU-2019:2109-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10608-1 No score

libSDL2_image-2_0-0-2.0.5-1.14 on GA media

These are all security issues fixed in the libSDL2_image-2_0-0-2.0.5-1.14 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10608-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10609-1 No score

libSDL_image-1_2-0-1.2.12+hg695-1.12 on GA media

These are all security issues fixed in the libSDL_image-1_2-0-1.2.12+hg695-1.12 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10609-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sdl2_image
Alpine:v3.10
 before 2.0.5-r0
2.0.5-r0
sdl2_image
Alpine:v3.7
 before 2.0.5-r0
2.0.5-r0
sdl2_image
Alpine:v3.8
 before 2.0.5-r0
2.0.5-r0
sdl2_image
Alpine:v3.9
 before 2.0.5-r0
2.0.5-r0
libsdl2-image
Debian:12
 before 2.0.5+dfsg1-1
2.0.5+dfsg1-1
libsdl2-image
Debian:13
 before 2.0.5+dfsg1-1
2.0.5+dfsg1-1
libsdl2-image
Debian:14
 before 2.0.5+dfsg1-1
2.0.5+dfsg1-1
sdl-image1.2
Debian:12
 before 1.2.12-11
1.2.12-11
sdl-image1.2
Debian:13
 before 1.2.12-11
1.2.12-11
sdl-image1.2
Debian:14
 before 1.2.12-11
1.2.12-11
Show 14 moreShow less
Affected packages
PackageAffectedFixed
SDL_image
Mageia:7
 before 1.2.12-12.1.mga7
1.2.12-12.1.mga7
sdl2_image
Mageia:7
 before 2.0.5-1.mga7
2.0.5-1.mga7
libsdl2-image
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.0.0+dfsg-22.0.0+dfsg-32.0.0+dfsg-3build22.0.0+dfsg-3+deb8u1build0.14.04.12.0.0+dfsg-3+deb8u2build0.14.04.1~esm1
 None known
libsdl2-image
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.0.0+dfsg-3build22.0.1+dfsg-12.0.1+dfsg-22.0.1+dfsg-2+deb9u1build0.16.04.1
 None known
libsdl2-image
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.0.1+dfsg-32.0.1+dfsg-42.0.2+dfsg1-12.0.3+dfsg1-1
 None known
libsdl2-image
Ubuntu:20.04:LTS
 before 2.0.5+dfsg1-1
2.0.5+dfsg1-1
SDL2_image
openSUSE:Leap 15.0
 before 2.0.5-lp151.2.5.1
2.0.5-lp151.2.5.1
SDL2_image
openSUSE:Leap 15.1
 before 2.0.5-lp151.2.5.1
2.0.5-lp151.2.5.1
SDL_image
openSUSE:Leap 15.0
 before 1.2.12+hg695-lp151.3.3.1
1.2.12+hg695-lp151.3.3.1
SDL_image
openSUSE:Leap 15.1
 before 1.2.12+hg695-lp151.3.3.1
1.2.12+hg695-lp151.3.3.1
SDL2_image
SUSE:Package Hub 15
 before 2.0.5-bp151.4.3.1
2.0.5-bp151.4.3.1
SDL2_image
SUSE:Package Hub 15 SP1
 before 2.0.5-bp151.4.3.1
2.0.5-bp151.4.3.1
SDL_image
SUSE:Package Hub 15
 before 1.2.12+hg695-bp151.4.3.1
1.2.12+hg695-bp151.4.3.1
SDL_image
SUSE:Package Hub 15 SP1
 before 1.2.12+hg695-bp151.4.3.1
1.2.12+hg695-bp151.4.3.1

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-5058 is a high vulnerability (CVSS 8.8) in Red Hat Sdl, published July 31, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.62%, the 89th percentile. Fixed in sdl2_image 2.0.5-r0.

References

Show 51 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open