Every CVE Search/ Get API key

CVE-2019-13616

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over...

8.1 HighFix available

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

3.73%Down 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.1

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.

Record
CVE-2019-13616
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:N/A:P
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.

Record
CVE-2019-13616
Updated
2026-11-02
EUVDEUVD-2019-5051 No score

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.

Record
EUVD-2019-5051
Updated
2026-11-03
GitHub AdvisoriesGHSA-v89f-grvw-gpv8 8.1

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over...

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.

Record
GHSA-v89f-grvw-gpv8
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVALPINE-CVE-2019-13616 8.1

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.

Record
ALPINE-CVE-2019-13616
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-03
OSVBELL-CVE-2019-13616 8.1

CVE-2019-13616 does not affect BellSoft software

Record
BELL-CVE-2019-13616
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
Show 30 moreShow less
OSV 8.1

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.

Record
CVE-2019-13616
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-13616 8.1

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.

Record
DEBIAN-CVE-2019-13616
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:3950 8.1

Red Hat Security Advisory: SDL security update

Record
RHSA-2019:3950
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:3951 8.1

Red Hat Security Advisory: SDL security update

Record
RHSA-2019:3951
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:0293 8.1

Red Hat Security Advisory: SDL security update

Record
RHSA-2020:0293
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-13616 8.1

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.

Record
UBUNTU-CVE-2019-13616
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVMGASA-2019-0254 No score

Updated SDL12 packages fix security vulnerability

Updated SDL12 packages fix security vulnerability:

SDL (Simple DirectMedia Layer) through 1.2.15 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c (CVE-2019-13616).

Record
MGASA-2019-0254
Updated
2026-11-02
OSVMGASA-2019-0363 No score

Updated SDL_image packages fix security vulnerabilities

The updated packages fix security vulnerabilities:

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.3. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (CVE-2018-3977)

An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A specially crafted file can cause an integer overflow, resulting in too little memory being allocated, which can lead to a buffer overflow and potential code execution. (CVE-2019-5052)

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. (CVE-2019-5058)

An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow, allocating too small of a buffer. This buffer can then be written out of bounds resulting in a heap overflow, ultimately ending in code execution. (CVE-2019-5059)

An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. (CVE-2019-5060)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (CVE-2019-7635).

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL stdio_read function in file/SDL_rwops.c. (CVE-2019-12217)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c. (CVE-2019-12218)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an invalid free error in the SDL function SDL_SetError_REAL at SDL_error.c. (CVE-2019-12219)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an out-of-bounds read in the SDL function SDL_FreePalette_REAL at video/SDL_pixels.c. (CVE-2019-12220)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a SEGV in the SDL function SDL_free_REAL at stdlib/SDL_malloc.c. (CVE-2019-12221)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the function SDL_InvalidateMap at video/SDL_pixels.c. (CVE-2019-12222)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c. (CVE-2019-13616)

Record
MGASA-2019-0363
Updated
2026-11-02
OSVMGASA-2019-0364 No score

Updated sdl2_image packages fix security vulnerabilities

Updated sdl2_image packages fix security vulnerabilities:

An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability. (CVE-2019-5051)

An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A specially crafted file can cause an integer overflow, resulting in too little memory being allocated, which can lead to a buffer overflow and potential code execution. (CVE-2019-5052)

An exploitable code execution vulnerability exists in the PCX image rendering functionality of SDL2_image 2.0.4. A specially crafted PCX image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (CVE-2019-5057)

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. (CVE-2019-5058)

An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow, allocating too small of a buffer. This buffer can then be written out of bounds resulting in a heap overflow, ultimately ending in code execution. (CVE-2019-5059)

An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. (CVE-2019-5060)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL stdio_read function in file/SDL_rwops.c. (CVE-2019-12217)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c. (CVE-2019-12218)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an invalid free error in the SDL function SDL_SetError_REAL at SDL_error.c. (CVE-2019-12219)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an out-of-bounds read in the SDL function SDL_FreePalette_REAL at video/SDL_pixels.c. (CVE-2019-12220)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a SEGV in the SDL function SDL_free_REAL at stdlib/SDL_malloc.c. (CVE-2019-12221)

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the function SDL_InvalidateMap at video/SDL_pixels.c. (CVE-2019-12222)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c. (CVE-2019-13616)

Record
MGASA-2019-0364
Updated
2026-11-02
OSVopenSUSE-SU-2019:2070-1 No score

Security update for SDL2_image

This update for SDL2_image fixes the following issues:

Update to new upstream release 2.0.5.

Security issues fixed:

  • TALOS-2019-0820 CVE-2019-5051: exploitable heap-based buffer overflow vulnerability when loading a PCX file (boo#1140419)
  • TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421)
  • TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763)
  • TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764)
  • TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image (boo#1143766)
  • TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768)

Not mentioned by upstream, but issues seemingly further fixed:

  • CVE-2019-12218: NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW (boo#1135789)
  • CVE-2019-12217: NULL pointer dereference in the SDL stdio_read function (boo#1135787)
  • CVE-2019-12220: SDL_image triggers an out-of-bounds read in the SDL function SDL_FreePalette_REAL (boo#1135806)
  • CVE-2019-12221: a SEGV caused by SDL_image in SDL function SDL_free_REAL in stdlib/SDL_malloc.c (boo#1135796)
  • CVE-2019-12222: out-of-bounds read triggered by SDL_image in the function SDL_InvalidateMap at video/SDL_pixels.c (boo#1136101)
  • CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844).
Record
openSUSE-SU-2019:2070-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2071-1 No score

Security update for SDL_image

This update for SDL_image fixes the following issues:

Update SDL_Image to new snapshot 1.2.12+hg695.

Security issues fixed:

  • TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421)
  • TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763)
  • TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764)
  • TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image handling (boo#1143766)
  • TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768)
  • CVE-2019-7635: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (boo#1124827)
  • CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844).
Record
openSUSE-SU-2019:2071-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2108-1 No score

Security update for SDL2_image

This update for SDL2_image fixes the following issues:

Update to new upstream release 2.0.5.

Security issues fixed:

  • TALOS-2019-0820 CVE-2019-5051: exploitable heap-based buffer overflow vulnerability when loading a PCX file (boo#1140419)
  • TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421)
  • TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763)
  • TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764)
  • TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image (boo#1143766)
  • TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768)

Not mentioned by upstream, but issues seemingly further fixed:

  • CVE-2019-12218: NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW (boo#1135789)
  • CVE-2019-12217: NULL pointer dereference in the SDL stdio_read function (boo#1135787)
  • CVE-2019-12220: SDL_image triggers an out-of-bounds read in the SDL function SDL_FreePalette_REAL (boo#1135806)
  • CVE-2019-12221: a SEGV caused by SDL_image in SDL function SDL_free_REAL in stdlib/SDL_malloc.c (boo#1135796)
  • CVE-2019-12222: out-of-bounds read triggered by SDL_image in the function SDL_InvalidateMap at video/SDL_pixels.c (boo#1136101)
  • CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844).

This update was imported from the openSUSE:Leap:15.0:Update update project.

Record
openSUSE-SU-2019:2108-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2109-1 No score

Security update for SDL_image

This update for SDL_image fixes the following issues:

Update SDL_Image to new snapshot 1.2.12+hg695.

Security issues fixed:

  • TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421)
  • TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763)
  • TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764)
  • TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image handling (boo#1143766)
  • TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768)
  • CVE-2019-7635: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (boo#1124827)
  • CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844).

This update was imported from the openSUSE:Leap:15.0:Update update project.

Record
openSUSE-SU-2019:2109-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2224-1 No score

Security update for SDL2

This update for SDL2 fixes the following issues:

Security issues fixed:

  • CVE-2019-13616: Fixed heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c (bsc#1141844).
  • CVE-2019-13626: Fixed integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c (bsc#1142031).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2224-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2226-1 No score

Security update for SDL2

This update for SDL2 fixes the following issues:

Security issues fixed:

  • CVE-2019-13616: Fixed heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c (bsc#1141844).
  • CVE-2019-13626: Fixed integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c (bsc#1142031).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2226-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1916-1 No score

Security update for SDL

This update for SDL fixes the following issues:

Security issue fixed:

  • CVE-2019-13616: Fixed heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit (bsc#1141844).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:1916-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1990-1 No score

Security update for SDL

This update for SDL fixes the following issues:

Security issue fixed:

  • CVE-2019-13616: Fixed heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit (bsc#1141844).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:1990-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10606-1 No score

libSDL-1_2-0-1.2.15-22.13 on GA media

These are all security issues fixed in the libSDL-1_2-0-1.2.15-22.13 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10606-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10607-1 No score

libSDL2-2_0-0-2.0.16-2.3 on GA media

These are all security issues fixed in the libSDL2-2_0-0-2.0.16-2.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10607-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10608-1 No score

libSDL2_image-2_0-0-2.0.5-1.14 on GA media

These are all security issues fixed in the libSDL2_image-2_0-0-2.0.5-1.14 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10608-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10609-1 No score

libSDL_image-1_2-0-1.2.12+hg695-1.12 on GA media

These are all security issues fixed in the libSDL_image-1_2-0-1.2.12+hg695-1.12 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10609-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15205-1 No score

SDL-1.2.15-1.1 on GA media

These are all security issues fixed in the SDL-1.2.15-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15205-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15206-1 No score

SDL2-2.32.8-1.1 on GA media

These are all security issues fixed in the SDL2-2.32.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15206-1
Updated
2026-11-02
OSVSUSE-SU-2019:2463-1 No score

Security update for SDL2

This update for SDL2 fixes the following issues:

Security issues fixed:

  • CVE-2019-13616: Fixed heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c (bsc#1141844).
  • CVE-2019-13626: Fixed integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c (bsc#1142031).
Record
SUSE-SU-2019:2463-1
Updated
2026-11-02
OSVSUSE-SU-2019:2463-2 No score

Security update for SDL2

This update for SDL2 fixes the following issues:

Security issues fixed:

  • CVE-2019-13616: Fixed heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c (bsc#1141844).
  • CVE-2019-13626: Fixed integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c (bsc#1142031).
Record
SUSE-SU-2019:2463-2
Updated
2026-11-02
OSVSUSE-SU-2020:3030-1 No score

Security update for SDL

This update for SDL fixes the following issues:

Secuirty issue fixed:

  • CVE-2019-13616: Fixed heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit (bsc#1141844).
Record
SUSE-SU-2020:3030-1
Updated
2026-11-02
OSVSUSE-SU-2020:3261-1 No score

Security update for SDL

This update for SDL fixes the following issues:

Security issue fixed:

  • CVE-2019-13616: Fixed heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit (bsc#1141844).
Record
SUSE-SU-2020:3261-1
Updated
2026-11-02
OSVUSN-4156-1 No score

libsdl1.2 vulnerabilities

It was discovered that SDL incorrectly handled certain images. If a user were tricked into opening a crafted image file, a remote attacker could use this issue to cause SDL to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-4156-1
Updated
2026-11-02
OSVUSN-4156-2 No score

libsdl1.2 vulnerabilities

USN-4156-1 fixed several vulnerabilities in SDL. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that SDL incorrectly handled certain images. If a user were tricked into opening a crafted image file, a remote attacker could use this issue to cause SDL to crash, resulting in a denial of service, or possibly execute arbitary code.

Record
USN-4156-2
Updated
2026-11-02
OSVUSN-4238-1 No score

sdl-image1.2 vulnerabilities

It was discovered that SDL_image incorrectly handled certain image files. An attacker could possibly use this issue to cause a denial of service or other unspecified impact.

Record
USN-4238-1
Updated
2026-11-02

Affected products

Show 1 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
sdl
Alpine:v3.10
 before 1.2.15-r12
1.2.15-r12
sdl
Alpine:v3.11
 before 1.2.15-r12
1.2.15-r12
sdl
Alpine:v3.12
 before 1.2.15-r12
1.2.15-r12
sdl
Alpine:v3.13
 before 1.2.15-r12
1.2.15-r12
sdl
Alpine:v3.14
 before 1.2.15-r12
1.2.15-r12
sdl
Alpine:v3.15
 before 1.2.15-r12
1.2.15-r12
sdl
Alpine:v3.7
 before 1.2.15-r9
1.2.15-r9
sdl
Alpine:v3.8
 before 1.2.15-r10
1.2.15-r10
sdl
Alpine:v3.9
 before 1.2.15-r11
1.2.15-r11
sdl2_image
Alpine:v3.11
 before 2.0.5-r1
2.0.5-r1
Show 107 moreShow less
Affected packages
PackageAffectedFixed
sdl2_image
Alpine:v3.12
 before 2.0.5-r1
2.0.5-r1
sdl2_image
Alpine:v3.13
 before 2.0.5-r1
2.0.5-r1
sdl2_image
Alpine:v3.14
 before 2.0.5-r1
2.0.5-r1
sdl2_image
Alpine:v3.15
 before 2.0.5-r1
2.0.5-r1
sdl2_image
Alpine:v3.16
 before 2.0.5-r1
2.0.5-r1
sdl2_image
Alpine:v3.17
 before 2.0.5-r1
2.0.5-r1
sdl2_image
Alpine:v3.18
 before 2.0.5-r1
2.0.5-r1
sdl2_image
Alpine:v3.19
 before 2.0.5-r1
2.0.5-r1
sdl2_image
Alpine:v3.20
 before 2.0.5-r1
2.0.5-r1
sdl2_image
Alpine:v3.21
 before 2.0.5-r1
2.0.5-r1
sdl2_image
Alpine:v3.22
 before 2.0.5-r1
2.0.5-r1
sdl2_image
Alpine:v3.23
 before 2.0.5-r1
2.0.5-r1
sdl2_image
Alpine:v3.24
 before 2.0.5-r1
2.0.5-r1
sdl_image
Alpine:v3.10
 before 1.2.12-r5
1.2.12-r5
sdl_image
Alpine:v3.11
 before 1.2.12-r5
1.2.12-r5
sdl_image
Alpine:v3.12
 before 1.2.12-r5
1.2.12-r5
sdl_image
Alpine:v3.13
 before 1.2.12-r5
1.2.12-r5
sdl_image
Alpine:v3.14
 before 1.2.12-r5
1.2.12-r5
sdl_image
Alpine:v3.15
 before 1.2.12-r5
1.2.12-r5
sdl_image
Alpine:v3.16
 before 1.2.12-r5
1.2.12-r5
sdl_image
Alpine:v3.17
 before 1.2.12-r5
1.2.12-r5
sdl_image
Alpine:v3.18
 before 1.2.12-r5
1.2.12-r5
sdl_image
Alpine:v3.19
 before 1.2.12-r5
1.2.12-r5
sdl_image
Alpine:v3.20
 before 1.2.12-r5
1.2.12-r5
sdl_image
Alpine:v3.21
 before 1.2.12-r5
1.2.12-r5
sdl_image
Alpine:v3.22
 before 1.2.12-r5
1.2.12-r5
sdl_image
Alpine:v3.23
 before 1.2.12-r5
1.2.12-r5
sdl_image
Alpine:v3.24
 before 1.2.12-r5
1.2.12-r5
sdl_image
Alpine:v3.7
 before 1.2.12-r4
1.2.12-r4
sdl_image
Alpine:v3.8
 before 1.2.12-r5
1.2.12-r5
sdl_image
Alpine:v3.9
 before 1.2.12-r5
1.2.12-r5
libsdl1.2
Debian:12
 before 1.2.15+dfsg2-5
1.2.15+dfsg2-5
libsdl2
Debian:12
 before 2.0.10+dfsg1-1
2.0.10+dfsg1-1
libsdl2
Debian:13
 before 2.0.10+dfsg1-1
2.0.10+dfsg1-1
libsdl2
Debian:14
 before 2.0.10+dfsg1-1
2.0.10+dfsg1-1
libsdl2-image
Debian:12
 before 2.0.5+dfsg1-2
2.0.5+dfsg1-2
libsdl2-image
Debian:13
 before 2.0.5+dfsg1-2
2.0.5+dfsg1-2
libsdl2-image
Debian:14
 before 2.0.5+dfsg1-2
2.0.5+dfsg1-2
sdl-image1.2
Debian:12
 before 1.2.12-12
1.2.12-12
sdl-image1.2
Debian:13
 before 1.2.12-12
1.2.12-12
sdl-image1.2
Debian:14
 before 1.2.12-12
1.2.12-12
libsdl2
Debian:9
 before 2.0.5+dfsg1-2+deb9u1, plus listed versions
2.0.5+dfsg1-2
2.0.5+dfsg1-2+deb9u1
libsdl1.2
Debian:9
 before 1.2.15+dfsg1-4+deb9u1, plus listed versions
1.2.15+dfsg1-4
1.2.15+dfsg1-4+deb9u1
libsdl2
Debian:10
 before 2.0.9+dfsg1-1+deb10u1, plus listed versions
2.0.9+dfsg1-1
2.0.9+dfsg1-1+deb10u1
SDL12
Mageia:6
 before 1.2.15-19.2.mga6
1.2.15-19.2.mga6
SDL12
Mageia:7
 before 1.2.15-23.1.mga7
1.2.15-23.1.mga7
SDL_image
Mageia:7
 before 1.2.12-12.1.mga7
1.2.12-12.1.mga7
sdl2_image
Mageia:7
 before 2.0.5-1.mga7
2.0.5-1.mga7
SDL
Red Hat:enterprise_linux:7::client
 before 0:1.2.15-14.el7_7
0:1.2.15-14.el7_7
SDL-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.2.15-14.el7_7
0:1.2.15-14.el7_7
SDL-devel
Red Hat:enterprise_linux:7::client
 before 0:1.2.15-14.el7_7
0:1.2.15-14.el7_7
SDL-static
Red Hat:enterprise_linux:7::client
 before 0:1.2.15-14.el7_7
0:1.2.15-14.el7_7
SDL
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.15-14.el7_7
0:1.2.15-14.el7_7
SDL-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.15-14.el7_7
0:1.2.15-14.el7_7
SDL-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.15-14.el7_7
0:1.2.15-14.el7_7
SDL-static
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.15-14.el7_7
0:1.2.15-14.el7_7
SDL
Red Hat:enterprise_linux:7::server
 before 0:1.2.15-14.el7_7
0:1.2.15-14.el7_7
SDL-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.2.15-14.el7_7
0:1.2.15-14.el7_7
SDL-devel
Red Hat:enterprise_linux:7::server
 before 0:1.2.15-14.el7_7
0:1.2.15-14.el7_7
SDL-static
Red Hat:enterprise_linux:7::server
 before 0:1.2.15-14.el7_7
0:1.2.15-14.el7_7
SDL
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.15-14.el7_7
0:1.2.15-14.el7_7
SDL-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.15-14.el7_7
0:1.2.15-14.el7_7
SDL-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.15-14.el7_7
0:1.2.15-14.el7_7
SDL-static
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.15-14.el7_7
0:1.2.15-14.el7_7
SDL
Red Hat:enterprise_linux:8::appstream
 before 0:1.2.15-36.el8_1
0:1.2.15-36.el8_1
SDL-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.2.15-36.el8_1
0:1.2.15-36.el8_1
SDL-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.2.15-36.el8_1
0:1.2.15-36.el8_1
SDL-devel
Red Hat:enterprise_linux:8::appstream
 before 0:1.2.15-36.el8_1
0:1.2.15-36.el8_1
SDL
Red Hat:rhel_e4s:8.0::appstream
 before 0:1.2.15-33.el8_0
0:1.2.15-33.el8_0
SDL-debuginfo
Red Hat:rhel_e4s:8.0::appstream
 before 0:1.2.15-33.el8_0
0:1.2.15-33.el8_0
SDL-debugsource
Red Hat:rhel_e4s:8.0::appstream
 before 0:1.2.15-33.el8_0
0:1.2.15-33.el8_0
SDL-devel
Red Hat:rhel_e4s:8.0::appstream
 before 0:1.2.15-33.el8_0
0:1.2.15-33.el8_0
SDL2
SUSE:Linux Enterprise Module for Desktop Applications 15
 before 2.0.8-3.15.1
2.0.8-3.15.1
SDL2
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
 before 2.0.8-3.15.1
2.0.8-3.15.1
SDL2
SUSE:Linux Enterprise Module for Package Hub 15 SP1
 before 2.0.8-3.15.1
2.0.8-3.15.1
SDL
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.2.15-15.14.2
1.2.15-15.14.2
SDL
SUSE:Linux Enterprise Server 12 SP5
 before 1.2.15-15.14.2
1.2.15-15.14.2
SDL
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.2.15-15.14.2
1.2.15-15.14.2
SDL
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
 before 1.2.15-3.12.73
1.2.15-3.12.73
SDL
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
 before 1.2.15-3.12.73
1.2.15-3.12.73
libsdl1.2
Ubuntu:Pro:14.04:LTS
 before 1.2.15-8ubuntu1.1+esm1, plus listed versions
1.2.15-5ubuntu21.2.15-5ubuntu31.2.15-8ubuntu11.2.15-8ubuntu1.1
1.2.15-8ubuntu1.1+esm1
sdl-image1.2
Ubuntu:Pro:14.04:LTS
 before 1.2.12-5+deb9u1ubuntu0.14.04.1~esm1, plus listed versions
1.2.12-4ubuntu11.2.12-51.2.12-5build21.2.12-5+deb9u1build0.14.04.1
1.2.12-5+deb9u1ubuntu0.14.04.1~esm1
libsdl2
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.0.0+dfsg1-22.0.0+dfsg1-32.0.1+dfsg1-12.0.1+dfsg1-1ubuntu12.0.2+dfsg1-3
Show 5 moreShow less
2.0.2+dfsg1-3ubuntu12.0.2+dfsg1-3ubuntu1.12.0.2+dfsg1-3ubuntu1.22.0.2+dfsg1-3ubuntu1.32.0.2+dfsg1-3ubuntu1.3+esm1
 None known
libsdl2-image
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.0.0+dfsg-22.0.0+dfsg-32.0.0+dfsg-3build22.0.0+dfsg-3+deb8u1build0.14.04.12.0.0+dfsg-3+deb8u2build0.14.04.1~esm1
 None known
libsdl1.2
Ubuntu:16.04:LTS
 before 1.2.15+dfsg1-3ubuntu0.1, plus listed versions
1.2.15-11ubuntu11.2.15-12ubuntu11.2.15+dfsg1-3
1.2.15+dfsg1-3ubuntu0.1
sdl-image1.2
Ubuntu:16.04:LTS
 before 1.2.12-5+deb9u1ubuntu0.16.04.1, plus listed versions
1.2.12-5build21.2.12-5+deb9u1build0.16.04.1
1.2.12-5+deb9u1ubuntu0.16.04.1
libsdl2
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.0.2+dfsg1-6ubuntu22.0.4+dfsg1-22.0.4+dfsg1-2ubuntu12.0.4+dfsg1-2ubuntu22.0.4+dfsg1-2ubuntu2.16.04.12.0.4+dfsg1-2ubuntu2.16.04.2
 None known
libsdl2-image
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.0.0+dfsg-3build22.0.1+dfsg-12.0.1+dfsg-22.0.1+dfsg-2+deb9u1build0.16.04.1
 None known
libsdl1.2
Ubuntu:18.04:LTS
 before 1.2.15+dfsg2-0.1ubuntu0.1, plus listed versions
1.2.15+dfsg2-0.1
1.2.15+dfsg2-0.1ubuntu0.1
sdl-image1.2
Ubuntu:18.04:LTS
 before 1.2.12-8ubuntu0.1, plus listed versions
1.2.12-61.2.12-71.2.12-8
1.2.12-8ubuntu0.1
libsdl2
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.0.6+dfsg1-3ubuntu12.0.6+dfsg1-4ubuntu12.0.7+dfsg1-3ubuntu12.0.8+dfsg1-1ubuntu12.0.8+dfsg1-1ubuntu1.18.04.12.0.8+dfsg1-1ubuntu1.18.04.32.0.8+dfsg1-1ubuntu1.18.04.42.0.8+dfsg1-1ubuntu1.18.04.4+esm1
 None known
libsdl2-image
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.0.1+dfsg-32.0.1+dfsg-42.0.2+dfsg1-12.0.3+dfsg1-1
 None known
SDL2_image
openSUSE:Leap 15.0
 before 2.0.5-lp151.2.5.1
2.0.5-lp151.2.5.1
SDL2_image
openSUSE:Leap 15.1
 before 2.0.5-lp151.2.5.1
2.0.5-lp151.2.5.1
SDL_image
openSUSE:Leap 15.0
 before 1.2.12+hg695-lp151.3.3.1
1.2.12+hg695-lp151.3.3.1
SDL_image
openSUSE:Leap 15.1
 before 1.2.12+hg695-lp151.3.3.1
1.2.12+hg695-lp151.3.3.1
SDL2_image
SUSE:Package Hub 15
 before 2.0.5-bp151.4.3.1
2.0.5-bp151.4.3.1
SDL2_image
SUSE:Package Hub 15 SP1
 before 2.0.5-bp151.4.3.1
2.0.5-bp151.4.3.1
SDL_image
SUSE:Package Hub 15
 before 1.2.12+hg695-bp151.4.3.1
1.2.12+hg695-bp151.4.3.1
SDL_image
SUSE:Package Hub 15 SP1
 before 1.2.12+hg695-bp151.4.3.1
1.2.12+hg695-bp151.4.3.1
SDL2
openSUSE:Leap 15.0
 before 2.0.8-lp150.2.9.1
2.0.8-lp150.2.9.1
SDL2
openSUSE:Leap 15.1
 before 2.0.8-lp151.4.6.1
2.0.8-lp151.4.6.1
SDL
openSUSE:Leap 15.2
 before 1.2.15-lp152.5.3.1
1.2.15-lp152.5.3.1
SDL
openSUSE:Leap 15.1
 before 1.2.15-lp151.4.3.1
1.2.15-lp151.4.3.1
SDL2
openSUSE:Tumbleweed
 before 2.0.16-2.3
2.0.16-2.3
SDL
openSUSE:Tumbleweed
 before 1.2.15-1.1
1.2.15-1.1
SDL2
openSUSE:Tumbleweed
 before 2.32.8-1.1
2.32.8-1.1

History

History
RecordedChangedSources
affectedOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-13616 is a high vulnerability (CVSS 8.1) in Libsdl Simple Directmedia Layer, published July 16, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.73%, the 89th percentile. Fixed in sdl 1.2.15-r12.

References

Show 131 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open