Every CVE Search/ Get API key

CVE-2017-2887

An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of...

8.8 HighFix available

An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.66%Up 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 8.8

An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability.

Record
CVE-2017-2887
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
EUVDEUVD-2017-12028 8.8

An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability.

Record
EUVD-2017-12028
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-hqjw-c32v-frhh 8.8

An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of...

An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability.

Record
GHSA-hqjw-c32v-frhh
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 8.8

An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability.

Record
CVE-2017-2887
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2017-2887 8.8

An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability.

Record
ALPINE-CVE-2017-2887
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.8

An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability.

Record
CVE-2017-2887
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2017-2887 8.8

An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability.

Record
DEBIAN-CVE-2017-2887
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-2887 8.8

An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability.

Record
UBUNTU-CVE-2017-2887
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2017-0397 No score

Updated sdl2_image & mingw packages fix security vulnerability

An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability (CVE-2017-2887).

Record
MGASA-2017-0397
Updated
2026-11-02
OSVMGASA-2018-0170 No score

Updated SDL_image packages fix security vulnerability

An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability (CVE-2017-2887).

Record
MGASA-2018-0170
Updated
2026-11-02
OSVopenSUSE-SU-2024:10608-1 No score

libSDL2_image-2_0-0-2.0.5-1.14 on GA media

These are all security issues fixed in the libSDL2_image-2_0-0-2.0.5-1.14 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10608-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sdl2_image
Alpine:v3.5
 before 2.0.1-r2
2.0.1-r2
sdl2_image
Alpine:v3.6
 before 2.0.1-r2
2.0.1-r2
libsdl2-image
Debian:12
 before 2.0.1+dfsg-4
2.0.1+dfsg-4
libsdl2-image
Debian:13
 before 2.0.1+dfsg-4
2.0.1+dfsg-4
libsdl2-image
Debian:14
 before 2.0.1+dfsg-4
2.0.1+dfsg-4
sdl-image1.2
Debian:12
 before 1.2.12-7
1.2.12-7
sdl-image1.2
Debian:13
 before 1.2.12-7
1.2.12-7
sdl-image1.2
Debian:14
 before 1.2.12-7
1.2.12-7
sdl-image1.2
Debian:7
 before 1.2.12-2+deb7u1, plus listed versions
1.2.12-2
1.2.12-2+deb7u1
libsdl2-image
Debian:8
 before 2.0.0+dfsg-3+deb8u1, plus listed versions
2.0.0+dfsg-3
2.0.0+dfsg-3+deb8u1
Show 13 moreShow less
Affected packages
PackageAffectedFixed
libsdl2-image
Debian:9
 before 2.0.1+dfsg-2+deb9u1, plus listed versions
2.0.1+dfsg-2
2.0.1+dfsg-2+deb9u1
sdl-image1.2
Debian:8
 before 1.2.12-5+deb8u1, plus listed versions
1.2.12-5
1.2.12-5+deb8u1
sdl-image1.2
Debian:9
 before 1.2.12-5+deb9u1, plus listed versions
1.2.12-5
1.2.12-5+deb9u1
sdl2_image
Mageia:5
 before 2.0.0-4.1.mga5
2.0.0-4.1.mga5
sdl2_image
Mageia:6
 before 2.0.1-1.1.mga6
2.0.1-1.1.mga6
mingw-SDL2_image
Mageia:6
 before 2.0.1-2.1.mga6
2.0.1-2.1.mga6
SDL_image
Mageia:5
 before 1.2.12-8.1.mga5
1.2.12-8.1.mga5
SDL_image
Mageia:6
 before 1.2.12-9.1.mga6
1.2.12-9.1.mga6
mingw-SDL_image
Mageia:6
 before 1.2.12-13.1.mga6
1.2.12-13.1.mga6
libsdl2-image
Ubuntu:14.04:LTS
 before 2.0.0+dfsg-3+deb8u1build0.14.04.1, plus listed versions
2.0.0+dfsg-22.0.0+dfsg-32.0.0+dfsg-3build2
2.0.0+dfsg-3+deb8u1build0.14.04.1
sdl-image1.2
Ubuntu:14.04:LTS
 before 1.2.12-5+deb9u1build0.14.04.1, plus listed versions
1.2.12-4ubuntu11.2.12-51.2.12-5build2
1.2.12-5+deb9u1build0.14.04.1
libsdl2-image
Ubuntu:16.04:LTS
 before 2.0.1+dfsg-2+deb9u1build0.16.04.1, plus listed versions
2.0.0+dfsg-3build22.0.1+dfsg-12.0.1+dfsg-2
2.0.1+dfsg-2+deb9u1build0.16.04.1
sdl-image1.2
Ubuntu:16.04:LTS
 before 1.2.12-5+deb9u1build0.16.04.1, plus listed versions
1.2.12-5build2
1.2.12-5+deb9u1build0.16.04.1

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-2887 is a high vulnerability (CVSS 8.8) in Cisco Systems, Inc. Simple Direct Media, published October 11, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.66%, the 85th percentile. Fixed in sdl2_image 2.0.1-r2.

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open