Every CVE Search/ Get API key

CVE-2019-7635

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over...

8.1 HighFix available

CVE-2019-7635 is a high vulnerability (CVSS 8.1) in Libsdl Simple Directmedia Layer, published February 8, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.54%, the 89th percentile. Fixed in sdl 1.2.15-r11.

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

3.54%Down 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.1

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.

Record
CVE-2019-7635
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:N/A:P
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.

Record
CVE-2019-7635
Updated
2026-11-02
EUVDEUVD-2019-17168 No score

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.

Record
EUVD-2019-17168
Updated
2026-11-03
GitHub AdvisoriesGHSA-c83x-cr7v-6qrf 8.1

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over...

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.

Record
GHSA-c83x-cr7v-6qrf
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVALPINE-CVE-2019-7635 8.1

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.

Record
ALPINE-CVE-2019-7635
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-03
OSVBELL-CVE-2019-7635 8.1

CVE-2019-7635 does not affect BellSoft software

Record
BELL-CVE-2019-7635
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
Show 25 moreShow less
OSV 8.1

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.

Record
CVE-2019-7635
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-7635 8.1

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.

Record
DEBIAN-CVE-2019-7635
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:3868 8.4

Red Hat Security Advisory: SDL security update

Record
RHSA-2020:3868
CVSS 3.0
8.4 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:4627 8.4

Red Hat Security Advisory: SDL security update

Record
RHSA-2020:4627
CVSS 3.0
8.4 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-7635 8.1

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.

Record
UBUNTU-CVE-2019-7635
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVMGASA-2019-0127 No score

Updated SDL12 packages fix security vulnerability

This release fixes various buffer overflows when parsing or processing damaged Waveform audio and BMP image files.

  • Fix CVE-2019-7577 (a buffer overread in MS_ADPCM_decode) (rhbz#1676510)
  • Fix CVE-2019-7575 (a buffer overwrite in MS_ADPCM_decode) (rhbz#1676744)
  • Fix CVE-2019-7574 (a buffer overread in IMA_ADPCM_decode) (rhbz#1676750)
  • Fix CVE-2019-7572 (a buffer overread in IMA_ADPCM_nibble) (rhbz#1676754)
  • Fix CVE-2019-7572 (a buffer overwrite in IMA_ADPCM_nibble) (rhbz#1676754)
  • Fix CVE-2019-7573, CVE-2019-7576 (buffer overreads in InitMS_ADPCM) (rhbz#1676752, rhbz#1676756)
  • Fix CVE-2019-7578 (a buffer overread in InitIMA_ADPCM) (rhbz#1676782)
  • Fix CVE-2019-7638, CVE-2019-7636 (buffer overflows when processing BMP images with too high number of colors) (rhbz#1677144, rhbz#1677157)
  • Fix CVE-2019-7637 (an integer overflow in SDL_CalculatePitch) (rhbz#1677152)
  • Fix CVE-2019-7635 (a buffer overread when blitting a BMP image with pixel colors out the palette) (rhbz#1677159)
  • Reject 2, 3, 5, 6, 7-bpp BMP images (rhbz#1677159)
Record
MGASA-2019-0127
Updated
2026-11-02
OSVMGASA-2019-0239 No score

Updated sdl2 packages fix security vulnerabilities

Updated sdl2 packages fix security vulnerabilities

This release fixes various buffer overflows when parsing or processing damaged Waveform audio and BMP image files.

  • Fix CVE-2019-7572 (a buffer overread in IMA_ADPCM_nibble) (rhbz#1676754)
  • Fix CVE-2019-7572 (a buffer overwrite in IMA_ADPCM_nibble) (rhbz#1676754)
  • Fix CVE-2019-7573, CVE-2019-7576 (buffer overreads in InitMS_ADPCM) (rhbz#1676752, rhbz#1676756)
  • Fix CVE-2019-7574 (a buffer overread in IMA_ADPCM_decode) (rhbz#1676750)
  • Fix CVE-2019-7575 (a buffer overwrite in MS_ADPCM_decode) (rhbz#1676744)
  • Fix CVE-2019-7577 (a buffer overread in MS_ADPCM_decode) (rhbz#1676510)
  • Fix CVE-2019-7578 (a buffer overread in InitIMA_ADPCM) (rhbz#1676782)
  • Fix CVE-2019-7635 (a buffer overread when blitting a BMP image with pixel colors out the palette) (rhbz#1677159)
  • Fix CVE-2019-7636, CVE-2019-7638 (buffer overflows when processing BMP images with too high number of colors) (rhbz#1677144, rhbz#1677157)
  • Fix CVE-2019-7637 (an integer overflow in SDL_CalculatePitch) (rhbz#1677152)
  • Reject 2, 3, 5, 6, 7-bpp BMP images (rhbz#1677159)
  • Fix CVE-2010-13616 (heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c)

The 2.0.10 release also provides various features and bug fixes.

Record
MGASA-2019-0239
Updated
2026-11-02
OSVMGASA-2019-0363 No score

Updated SDL_image packages fix security vulnerabilities

The updated packages fix security vulnerabilities:

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.3. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (CVE-2018-3977)

An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A specially crafted file can cause an integer overflow, resulting in too little memory being allocated, which can lead to a buffer overflow and potential code execution. (CVE-2019-5052)

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. (CVE-2019-5058)

An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow, allocating too small of a buffer. This buffer can then be written out of bounds resulting in a heap overflow, ultimately ending in code execution. (CVE-2019-5059)

An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. (CVE-2019-5060)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (CVE-2019-7635).

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL stdio_read function in file/SDL_rwops.c. (CVE-2019-12217)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c. (CVE-2019-12218)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an invalid free error in the SDL function SDL_SetError_REAL at SDL_error.c. (CVE-2019-12219)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an out-of-bounds read in the SDL function SDL_FreePalette_REAL at video/SDL_pixels.c. (CVE-2019-12220)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a SEGV in the SDL function SDL_free_REAL at stdlib/SDL_malloc.c. (CVE-2019-12221)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the function SDL_InvalidateMap at video/SDL_pixels.c. (CVE-2019-12222)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c. (CVE-2019-13616)

Record
MGASA-2019-0363
Updated
2026-11-02
OSVopenSUSE-SU-2019:1223-1 No score

Security update for SDL

This update for SDL fixes the following issues:

Security issues fixed:

  • CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).
  • CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).
  • CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).
  • CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).
  • CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).
  • CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).
  • CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).
  • CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).
  • CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).
  • CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).
  • CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:1223-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:1261-1 No score

Security update for SDL2

This update for SDL2 fixes the following issues:

Security issues fixed:

  • CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).
  • CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).
  • CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).
  • CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).
  • CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).
  • CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).
  • CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).
  • CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).
  • CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).
  • CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).
  • CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:1261-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2071-1 No score

Security update for SDL_image

This update for SDL_image fixes the following issues:

Update SDL_Image to new snapshot 1.2.12+hg695.

Security issues fixed:

  • TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421)
  • TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763)
  • TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764)
  • TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image handling (boo#1143766)
  • TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768)
  • CVE-2019-7635: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (boo#1124827)
  • CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844).
Record
openSUSE-SU-2019:2071-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2109-1 No score

Security update for SDL_image

This update for SDL_image fixes the following issues:

Update SDL_Image to new snapshot 1.2.12+hg695.

Security issues fixed:

  • TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421)
  • TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763)
  • TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764)
  • TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image handling (boo#1143766)
  • TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768)
  • CVE-2019-7635: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (boo#1124827)
  • CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844).

This update was imported from the openSUSE:Leap:15.0:Update update project.

Record
openSUSE-SU-2019:2109-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10606-1 No score

libSDL-1_2-0-1.2.15-22.13 on GA media

These are all security issues fixed in the libSDL-1_2-0-1.2.15-22.13 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10606-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10607-1 No score

libSDL2-2_0-0-2.0.16-2.3 on GA media

These are all security issues fixed in the libSDL2-2_0-0-2.0.16-2.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10607-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10609-1 No score

libSDL_image-1_2-0-1.2.12+hg695-1.12 on GA media

These are all security issues fixed in the libSDL_image-1_2-0-1.2.12+hg695-1.12 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10609-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15205-1 No score

SDL-1.2.15-1.1 on GA media

These are all security issues fixed in the SDL-1.2.15-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15205-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15206-1 No score

SDL2-2.32.8-1.1 on GA media

These are all security issues fixed in the SDL2-2.32.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15206-1
Updated
2026-11-02
OSVSUSE-SU-2019:0899-1 No score

Security update for SDL

This update for SDL fixes the following issues:

Security issues fixed:

  • CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).
  • CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).
  • CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).
  • CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).
  • CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).
  • CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).
  • CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).
  • CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).
  • CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).
  • CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).
  • CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).
Record
SUSE-SU-2019:0899-1
Updated
2026-11-02
OSVSUSE-SU-2019:0917-1 No score

Security update for SDL

This update for SDL fixes the following issues:

Security issues fixed:

  • CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).
  • CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).
  • CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).
  • CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).
  • CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).
  • CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).
  • CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).
  • CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).
  • CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).
  • CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).
  • CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).
Record
SUSE-SU-2019:0917-1
Updated
2026-11-02
OSVSUSE-SU-2019:0950-1 No score

Security update for SDL2

This update for SDL2 fixes the following issues:

Security issues fixed:

  • CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).
  • CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).
  • CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).
  • CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).
  • CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).
  • CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).
  • CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).
  • CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).
  • CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).
  • CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).
  • CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).
Record
SUSE-SU-2019:0950-1
Updated
2026-11-02
OSVSUSE-SU-2019:13998-1 No score

Security update for SDL

This update for SDL fixes the following issues:

Security issues fixed:

  • CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).
  • CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).
  • CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).
  • CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).
  • CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).
  • CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).
  • CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).
  • CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).
  • CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).
  • CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).
  • CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).
Record
SUSE-SU-2019:13998-1
Updated
2026-11-02
OSVUSN-4143-1 No score

SDL 2.0 vulnerabilities

It was discovered that SDL 2.0 mishandled crafted image files resulting in an integer overflow. If a user were tricked into opening a malicious file, SDL 2.0 could be caused to crash or potentially run arbitrary code. (CVE-2017-2888)

It was discovered that SDL 2.0 mishandled crafted image files. If a user were tricked into opening a malicious file, SDL 2.0 could be caused to crash or potentially run arbitrary code. (CVE-2019-7635, CVE-2019-7636, CVE-2019-7637, CVE-2019-7638)

Record
USN-4143-1
Updated
2026-11-02
OSVUSN-4156-1 No score

libsdl1.2 vulnerabilities

It was discovered that SDL incorrectly handled certain images. If a user were tricked into opening a crafted image file, a remote attacker could use this issue to cause SDL to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-4156-1
Updated
2026-11-02
OSVUSN-4156-2 No score

libsdl1.2 vulnerabilities

USN-4156-1 fixed several vulnerabilities in SDL. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that SDL incorrectly handled certain images. If a user were tricked into opening a crafted image file, a remote attacker could use this issue to cause SDL to crash, resulting in a denial of service, or possibly execute arbitary code.

Record
USN-4156-2
Updated
2026-11-02
OSVUSN-4238-1 No score

sdl-image1.2 vulnerabilities

It was discovered that SDL_image incorrectly handled certain image files. An attacker could possibly use this issue to cause a denial of service or other unspecified impact.

Record
USN-4238-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sdl
Alpine:v3.10
 before 1.2.15-r11
1.2.15-r11
sdl
Alpine:v3.11
 before 1.2.15-r11
1.2.15-r11
sdl
Alpine:v3.12
 before 1.2.15-r11
1.2.15-r11
sdl
Alpine:v3.13
 before 1.2.15-r11
1.2.15-r11
sdl
Alpine:v3.14
 before 1.2.15-r11
1.2.15-r11
sdl
Alpine:v3.15
 before 1.2.15-r11
1.2.15-r11
sdl
Alpine:v3.7
 before 1.2.15-r8
1.2.15-r8
sdl
Alpine:v3.8
 before 1.2.15-r9
1.2.15-r9
sdl
Alpine:v3.9
 before 1.2.15-r10
1.2.15-r10
sdl2
Alpine:v3.10
 before 2.0.10-r0
2.0.10-r0
Show 95 moreShow less
Affected packages
PackageAffectedFixed
sdl2
Alpine:v3.11
 before 2.0.10-r0
2.0.10-r0
sdl2
Alpine:v3.12
 before 2.0.10-r0
2.0.10-r0
sdl2
Alpine:v3.13
 before 2.0.10-r0
2.0.10-r0
sdl2
Alpine:v3.14
 before 2.0.10-r0
2.0.10-r0
sdl2
Alpine:v3.15
 before 2.0.10-r0
2.0.10-r0
sdl2
Alpine:v3.16
 before 2.0.10-r0
2.0.10-r0
sdl2
Alpine:v3.17
 before 2.0.10-r0
2.0.10-r0
sdl2
Alpine:v3.18
 before 2.0.10-r0
2.0.10-r0
sdl2
Alpine:v3.19
 before 2.0.10-r0
2.0.10-r0
sdl2
Alpine:v3.20
 before 2.0.10-r0
2.0.10-r0
sdl2
Alpine:v3.21
 before 2.0.10-r0
2.0.10-r0
sdl2
Alpine:v3.22
 before 2.0.10-r0
2.0.10-r0
sdl2
Alpine:v3.23
 before 2.0.10-r0
2.0.10-r0
sdl2
Alpine:v3.24
 before 2.0.10-r0
2.0.10-r0
sdl2
Alpine:v3.7
 before 2.0.10-r0
2.0.10-r0
sdl2
Alpine:v3.8
 before 2.0.10-r0
2.0.10-r0
sdl2
Alpine:v3.9
 before 2.0.10-r0
2.0.10-r0
libsdl1.2
Debian:12
 before 1.2.15+dfsg2-5
1.2.15+dfsg2-5
libsdl2
Debian:12
 before 2.0.10+dfsg1-1
2.0.10+dfsg1-1
libsdl2
Debian:13
 before 2.0.10+dfsg1-1
2.0.10+dfsg1-1
libsdl2
Debian:14
 before 2.0.10+dfsg1-1
2.0.10+dfsg1-1
libsdl2-image
Debian:12
 before 2.0.5+dfsg1-1
2.0.5+dfsg1-1
libsdl2-image
Debian:13
 before 2.0.5+dfsg1-1
2.0.5+dfsg1-1
libsdl2-image
Debian:14
 before 2.0.5+dfsg1-1
2.0.5+dfsg1-1
sdl-image1.2
Debian:12
 before 1.2.12-11
1.2.12-11
sdl-image1.2
Debian:13
 before 1.2.12-11
1.2.12-11
sdl-image1.2
Debian:14
 before 1.2.12-11
1.2.12-11
libsdl1.2
Debian:8
 before 1.2.15-10+deb8u1, plus listed versions
1.2.15-10
1.2.15-10+deb8u1
libsdl2
Debian:8
 before 2.0.2+dfsg1-6+deb8u1, plus listed versions
2.0.2+dfsg1-6
2.0.2+dfsg1-6+deb8u1
libsdl2-image
Debian:8
 before 2.0.0+dfsg-3+deb8u2, plus listed versions
2.0.0+dfsg-32.0.0+dfsg-3+deb8u1
2.0.0+dfsg-3+deb8u2
sdl-image1.2
Debian:8
 before 1.2.12-5+deb8u2, plus listed versions
1.2.12-51.2.12-5+deb8u1
1.2.12-5+deb8u2
libsdl2
Debian:9
 before 2.0.5+dfsg1-2+deb9u1, plus listed versions
2.0.5+dfsg1-2
2.0.5+dfsg1-2+deb9u1
libsdl1.2
Debian:9
 before 1.2.15+dfsg1-4+deb9u1, plus listed versions
1.2.15+dfsg1-4
1.2.15+dfsg1-4+deb9u1
libsdl2
Debian:10
 before 2.0.9+dfsg1-1+deb10u1, plus listed versions
2.0.9+dfsg1-1
2.0.9+dfsg1-1+deb10u1
SDL12
Mageia:6
 before 1.2.15-19.1.mga6
1.2.15-19.1.mga6
mingw-SDL
Mageia:6
 before 1.2.15-8.1.mga6
1.2.15-8.1.mga6
sdl2
Mageia:6
 before 2.0.10-1.mga6
2.0.10-1.mga6
mingw-SDL2
Mageia:6
 before 2.0.10-1.mga6
2.0.10-1.mga6
sdl2
Mageia:7
 before 2.0.10-1.mga7
2.0.10-1.mga7
mingw-SDL2
Mageia:7
 before 2.0.10-1.mga7
2.0.10-1.mga7
SDL_image
Mageia:7
 before 1.2.12-12.1.mga7
1.2.12-12.1.mga7
SDL
Red Hat:enterprise_linux:7::client
 before 0:1.2.15-17.el7
0:1.2.15-17.el7
SDL-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.2.15-17.el7
0:1.2.15-17.el7
SDL-devel
Red Hat:enterprise_linux:7::client
 before 0:1.2.15-17.el7
0:1.2.15-17.el7
SDL-static
Red Hat:enterprise_linux:7::client
 before 0:1.2.15-17.el7
0:1.2.15-17.el7
SDL
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.15-17.el7
0:1.2.15-17.el7
SDL-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.15-17.el7
0:1.2.15-17.el7
SDL-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.15-17.el7
0:1.2.15-17.el7
SDL-static
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.15-17.el7
0:1.2.15-17.el7
SDL
Red Hat:enterprise_linux:7::server
 before 0:1.2.15-17.el7
0:1.2.15-17.el7
SDL-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.2.15-17.el7
0:1.2.15-17.el7
SDL-devel
Red Hat:enterprise_linux:7::server
 before 0:1.2.15-17.el7
0:1.2.15-17.el7
SDL-static
Red Hat:enterprise_linux:7::server
 before 0:1.2.15-17.el7
0:1.2.15-17.el7
SDL
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.15-17.el7
0:1.2.15-17.el7
SDL-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.15-17.el7
0:1.2.15-17.el7
SDL-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.15-17.el7
0:1.2.15-17.el7
SDL-static
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.15-17.el7
0:1.2.15-17.el7
SDL
Red Hat:enterprise_linux:8::appstream
 before 0:1.2.15-38.el8
0:1.2.15-38.el8
SDL-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.2.15-38.el8
0:1.2.15-38.el8
SDL-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.2.15-38.el8
0:1.2.15-38.el8
SDL-devel
Red Hat:enterprise_linux:8::appstream
 before 0:1.2.15-38.el8
0:1.2.15-38.el8
SDL
SUSE:Linux Enterprise Desktop 12 SP3
 before 1.2.15-15.11.1
1.2.15-15.11.1
SDL
SUSE:Linux Enterprise Desktop 12 SP4
 before 1.2.15-15.11.1
1.2.15-15.11.1
SDL
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 1.2.15-15.11.1
1.2.15-15.11.1
SDL
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 1.2.15-15.11.1
1.2.15-15.11.1
SDL
SUSE:Linux Enterprise Server 12 SP3
 before 1.2.15-15.11.1
1.2.15-15.11.1
SDL
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 1.2.15-15.11.1
1.2.15-15.11.1
SDL
SUSE:Linux Enterprise Server 12 SP4
 before 1.2.15-15.11.1
1.2.15-15.11.1
SDL
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 1.2.15-15.11.1
1.2.15-15.11.1
SDL
SUSE:Linux Enterprise Module for Desktop Applications 15
 before 1.2.15-3.9.1
1.2.15-3.9.1
SDL2
SUSE:Linux Enterprise Module for Desktop Applications 15
 before 2.0.8-3.9.1
2.0.8-3.9.1
SDL
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 1.2.13-106.11.1
1.2.13-106.11.1
SDL
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 1.2.13-106.11.1
1.2.13-106.11.1
SDL
SUSE:Linux Enterprise Server 11 SP4
 before 1.2.13-106.11.1
1.2.13-106.11.1
SDL
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 1.2.13-106.11.1
1.2.13-106.11.1
libsdl1.2
Ubuntu:Pro:14.04:LTS
 before 1.2.15-8ubuntu1.1+esm1, plus listed versions
1.2.15-5ubuntu21.2.15-5ubuntu31.2.15-8ubuntu11.2.15-8ubuntu1.1
1.2.15-8ubuntu1.1+esm1
libsdl2-image
Ubuntu:Pro:14.04:LTS
 before 2.0.0+dfsg-3+deb8u2build0.14.04.1~esm1, plus listed versions
2.0.0+dfsg-22.0.0+dfsg-32.0.0+dfsg-3build22.0.0+dfsg-3+deb8u1build0.14.04.1
2.0.0+dfsg-3+deb8u2build0.14.04.1~esm1
sdl-image1.2
Ubuntu:Pro:14.04:LTS
 before 1.2.12-5+deb9u1ubuntu0.14.04.1~esm1, plus listed versions
1.2.12-4ubuntu11.2.12-51.2.12-5build21.2.12-5+deb9u1build0.14.04.1
1.2.12-5+deb9u1ubuntu0.14.04.1~esm1
libsdl1.2
Ubuntu:16.04:LTS
 before 1.2.15+dfsg1-3ubuntu0.1, plus listed versions
1.2.15-11ubuntu11.2.15-12ubuntu11.2.15+dfsg1-3
1.2.15+dfsg1-3ubuntu0.1
libsdl2
Ubuntu:16.04:LTS
 before 2.0.4+dfsg1-2ubuntu2.16.04.2, plus listed versions
2.0.2+dfsg1-6ubuntu22.0.4+dfsg1-22.0.4+dfsg1-2ubuntu12.0.4+dfsg1-2ubuntu22.0.4+dfsg1-2ubuntu2.16.04.1
2.0.4+dfsg1-2ubuntu2.16.04.2
sdl-image1.2
Ubuntu:16.04:LTS
 before 1.2.12-5+deb9u1ubuntu0.16.04.1, plus listed versions
1.2.12-5build21.2.12-5+deb9u1build0.16.04.1
1.2.12-5+deb9u1ubuntu0.16.04.1
libsdl2-image
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.0.0+dfsg-3build22.0.1+dfsg-12.0.1+dfsg-22.0.1+dfsg-2+deb9u1build0.16.04.1
 None known
libsdl1.2
Ubuntu:18.04:LTS
 before 1.2.15+dfsg2-0.1ubuntu0.1, plus listed versions
1.2.15+dfsg2-0.1
1.2.15+dfsg2-0.1ubuntu0.1
libsdl2
Ubuntu:18.04:LTS
 before 2.0.8+dfsg1-1ubuntu1.18.04.4, plus listed versions
2.0.6+dfsg1-3ubuntu12.0.6+dfsg1-4ubuntu12.0.7+dfsg1-3ubuntu12.0.8+dfsg1-1ubuntu12.0.8+dfsg1-1ubuntu1.18.04.12.0.8+dfsg1-1ubuntu1.18.04.3
2.0.8+dfsg1-1ubuntu1.18.04.4
sdl-image1.2
Ubuntu:18.04:LTS
 before 1.2.12-8ubuntu0.1, plus listed versions
1.2.12-61.2.12-71.2.12-8
1.2.12-8ubuntu0.1
libsdl2-image
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.0.1+dfsg-32.0.1+dfsg-42.0.2+dfsg1-12.0.3+dfsg1-1
 None known
SDL
openSUSE:Leap 15.0
 before 1.2.15-lp150.2.3.1
1.2.15-lp150.2.3.1
SDL2
openSUSE:Leap 15.0
 before 2.0.8-lp150.2.3.1
2.0.8-lp150.2.3.1
SDL_image
openSUSE:Leap 15.0
 before 1.2.12+hg695-lp151.3.3.1
1.2.12+hg695-lp151.3.3.1
SDL_image
openSUSE:Leap 15.1
 before 1.2.12+hg695-lp151.3.3.1
1.2.12+hg695-lp151.3.3.1
SDL_image
SUSE:Package Hub 15
 before 1.2.12+hg695-bp151.4.3.1
1.2.12+hg695-bp151.4.3.1
SDL_image
SUSE:Package Hub 15 SP1
 before 1.2.12+hg695-bp151.4.3.1
1.2.12+hg695-bp151.4.3.1
SDL2
openSUSE:Tumbleweed
 before 2.0.16-2.3
2.0.16-2.3
SDL
openSUSE:Tumbleweed
 before 1.2.15-1.1
1.2.15-1.1
SDL2
openSUSE:Tumbleweed
 before 2.32.8-1.1
2.32.8-1.1

History

History
WhenChangedSources
2026-11-03affectedOSV
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 158 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open