{"id":"CVE-2017-12122","aliases":["ALPINE-CVE-2017-12122","DEBIAN-CVE-2017-12122","DLA-1341-1","DSA-4177-1","DSA-4184-1","EUVD-2017-3706","GHSA-vmfr-6chp-w9mf","MGASA-2018-0276","MGASA-2018-0454","SUSE-SU-2018:3657-1","UBUNTU-CVE-2017-12122","openSUSE-SU-2024:10608-1"],"status":"published","title":"An exploitable code execution vulnerability exists in the ILBM image rendering functionality of...","description":"An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0235,"percentile":0.8381,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-787"],"published":"2018-04-06T00:00:00Z","modified":"2026-09-01T20:03:42Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"sdl2_image","fixed_in":["2.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"sdl2_image","fixed_in":["2.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"sdl2_image","fixed_in":["2.0.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"sdl2_image","fixed_in":["2.0.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"sdl2_image","fixed_in":["2.0.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"sdl2_image","fixed_in":["2.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"sdl2_image","fixed_in":["2.0.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libsdl2-image","fixed_in":["2.0.3+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libsdl2-image","fixed_in":["2.0.3+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libsdl2-image","fixed_in":["2.0.3+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"sdl-image1.2","fixed_in":["1.2.12-8"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sdl-image1.2","fixed_in":["1.2.12-8"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sdl-image1.2","fixed_in":["1.2.12-8"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libsdl2-image","fixed_in":["2.0.0+dfsg-3+deb8u1build0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"sdl-image1.2","fixed_in":["1.2.12-5+deb9u1build0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libsdl2-image","fixed_in":["2.0.1+dfsg-2+deb9u1build0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"sdl-image1.2","fixed_in":["1.2.12-5+deb9u1build0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"sdl2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"sdl2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"sdl2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"sdl2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"sdl2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"sdl2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"sdl2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-8"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-8"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-8"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-2+deb7u2"}]}],"versions":["1.2.12-2","1.2.12-2+deb7u1"],"bundled":9},{"source":"osv","ecosystem":"Debian:8","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-3+deb8u1"}]}],"versions":["2.0.0+dfsg-3"],"bundled":11},{"source":"osv","ecosystem":"Debian:9","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1+dfsg-2+deb9u1"}]}],"versions":["2.0.1+dfsg-2"],"bundled":11},{"source":"osv","ecosystem":"Debian:8","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-5+deb8u1"}]}],"versions":["1.2.12-5"],"bundled":10},{"source":"osv","ecosystem":"Debian:9","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-5+deb9u1"}]}],"versions":["1.2.12-5"],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"SDL_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-8.2.mga5"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:6","package":"SDL_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-9.2.mga6"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:6","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-1.mga6"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:6","package":"sdl2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-1.mga6"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:6","package":"sdl2_mixer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-1.mga6"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:6","package":"mingw-SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-1.mga6"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:6","package":"mingw-SDL2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-1.mga6"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:6","package":"mingw-SDL2_mixer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-1.mga6"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"SDL_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-84.42.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-3+deb8u1build0.14.04.1"}]}],"versions":["2.0.0+dfsg-2","2.0.0+dfsg-3","2.0.0+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-5+deb9u1build0.14.04.1"}]}],"versions":["1.2.12-4ubuntu1","1.2.12-5","1.2.12-5build2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1+dfsg-2+deb9u1build0.16.04.1"}]}],"versions":["2.0.0+dfsg-3build2","2.0.1+dfsg-1","2.0.1+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-5+deb9u1build0.16.04.1"}]}],"versions":["1.2.12-5build2"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"libsdl","product":"sdl_image"},{"vendor":"sam lantinga and mattias engdegård","product":"simple directmedia layer"},{"vendor":"simple directmedia layer","product":"simple directmedia layer"}],"references":[{"url":"https://www.debian.org/security/2018/dsa-4177","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00005.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4184","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/201903-17","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0488","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12122"},{"url":"https://github.com/advisories/GHSA-vmfr-6chp-w9mf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-12122","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-12122","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0276.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22967","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2018-0454.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22769","tags":["report"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0488","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0489","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0490","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0491","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0497","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0498","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0499","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0519","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0520","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0521","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0645","tags":["web"]},{"url":"https://hg.libsdl.org/SDL/file/8feb5da6f2fb/WhatsNew.txt","tags":["web"]},{"url":"https://www.libsdl.org/projects/SDL_image/","tags":["web"]},{"url":"https://www.libsdl.org/projects/SDL_mixer/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183657-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1084256","tags":["report"]},{"url":"https://bugzilla.suse.com/1084257","tags":["report"]},{"url":"https://bugzilla.suse.com/1084288","tags":["report"]},{"url":"https://bugzilla.suse.com/1084303","tags":["report"]},{"url":"https://bugzilla.suse.com/1084304","tags":["report"]},{"url":"https://bugzilla.suse.com/1089087","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3839","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-12122","tags":["report"]},{"url":"https://hg.libsdl.org/SDL_image/rev/16772bbb1b09","tags":["report"]},{"url":"https://hg.libsdl.org/SDL_image/rev/97f7f01e0665","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12122","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5060","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-12122","description":"An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","status":"published","published":"2018-04-24T19:00:00Z","modified":"2024-09-16T22:40:57.754Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:33:17.264801Z"}],"euvd":[{"id":"EUVD-2017-3706","description":"An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","status":"published","published":"2018-04-24T19:00:00Z","modified":"2024-09-16T22:40:57Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:00.660655Z"}],"ghsa":[{"id":"GHSA-vmfr-6chp-w9mf","title":"An exploitable code execution vulnerability exists in the ILBM image rendering functionality of...","description":"An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","status":"published","published":"2022-05-13T01:01:36Z","modified":"2023-01-30T05:05:14Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:47:13.441339Z"}],"nvd":[{"id":"CVE-2017-12122","description":"An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","status":"published","published":"2018-04-24T19:29:01.547Z","modified":"2026-06-17T01:02:43.43Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:17.032862Z"}],"osv":[{"id":"ALPINE-CVE-2017-12122","description":"An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","status":"published","published":"2018-04-24T19:29:01.547Z","modified":"2026-06-15T18:24:34.701807434Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-12122","description":"An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","status":"published","published":"2018-04-24T19:29:01.547Z","modified":"2026-04-16T06:16:50.142560662Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.159616Z"},{"id":"DEBIAN-CVE-2017-12122","description":"An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","status":"published","published":"2018-04-24T19:29:01.547Z","modified":"2026-09-01T20:03:42.242519429Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"UBUNTU-CVE-2017-12122","description":"An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","status":"published","published":"2018-04-24T19:29:00Z","modified":"2026-04-22T11:11:59.498821Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"DLA-1341-1","title":"sdl-image1.2 - security update","status":"published","published":"2018-04-06T00:00:00Z","modified":"2026-03-09T01:01:32.25784Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4177-1","title":"libsdl2-image - security update","status":"published","published":"2018-04-20T00:00:00Z","modified":"2026-03-09T01:21:09.761527Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"DSA-4184-1","title":"sdl-image1.2 - security update","status":"published","published":"2018-04-28T00:00:00Z","modified":"2026-03-09T01:19:36.868169Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0276","title":"Updated SDL_image packages fix security vulnerability","description":"Multiple vulnerabilities have been discovered in the image loading library\nfor Simple DirectMedia Layer 1.2, which could result in denial of service\nor the execution of arbitrary code if malformed image files are opened\n(CVE-2017-12122, CVE-2017-14440, CVE-2017-14441, CVE-2017-14442,\nCVE-2017-14448, CVE-2017-14450, CVE-2018-3837, CVE-2018-3838,\nCVE-2018-3839).\n","status":"published","published":"2018-06-06T18:15:31Z","modified":"2026-04-16T06:25:00.687548656Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"MGASA-2018-0454","title":"Updated sdl2/mingw-SDL2 packages fix security vulnerabilities","description":"This update fixes various security vulnerabilities affecting the\nSDL2_image library, listed below. The fixes are provided in SDL2_image\n2.0.4, which depends on SDL2 2.0.8 or later. As such, the SDL2 and\nSDL2_mixer libraries are also updated to their current stable releases,\nproviding various bug fixes and features.\n\nThe security vulnerabilities fixed in this update are the following:\n\nAn exploitable code execution vulnerability exists in the ILBM image\nrendering functionality of SDL2_image-2.0.2. A specially crafted ILBM\nimage can cause a heap overflow resulting in code execution. An attacker\ncan display a specially crafted image to trigger this vulnerability.\n(TALOS-2017-0488, CVE-2017-12122)\n\nAn exploitable code execution vulnerability exists in the ILBM image\nrendering functionality of SDL2_image-2.0.2. A specially crafted ILBM\nimage can cause a stack overflow resulting in code execution. An\nattacker can display a specially crafted image to trigger this\nvulnerability. (TALOS-2017-0489, CVE-2017-14440)\n\nAn exploitable code execution vulnerability exists in the ICO image\nrendering functionality of SDL2_image-2.0.2. A specially crafted ICO\nimage can cause an integer overflow, cascading to a heap overflow\nresulting in code execution. An attacker can display a specially crafted\nimage to trigger this vulnerability. (TALOS-2017-0490, CVE-2017-14441)\n\nAn exploitable code execution vulnerability exists in the BMP image\nrendering functionality of SDL2_image-2.0.2. A specially crafted BMP\nimage can cause a stack overflow resulting in code execution. An\nattacker can display a specially crafted image to trigger this\nvulnerability. (TALOS-2017-0491, CVE-2017-14442)\n\nAn exploitable code execution vulnerability exists in the XCF image\nrendering functionality of SDL2_image-2.0.2. A specially crafted XCF\nimage can cause a heap overflow resulting in code execution. An\nattacker can display a specially crafted image to trigger this\nvulnerability. (TALOS-2017-0497, CVE-2017-14448)\n\nA double-Free vulnerability exists in the XCF image rendering\nfunctionality of SDL2_image-2.0.2. A specially crafted XCF image can\ncause a Double-Free situation to occur. An attacker can display a\nspecially crafted image to trigger this vulnerability.\n(TALOS-2017-0498, CVE-2017-14449)\n\nA buffer overflow vulnerability exists in the GIF image parsing\nfunctionality of SDL2_image-2.0.2. A specially crafted GIF image can\nlead to a buffer overflow on a global section. An attacker can display\nan image to trigger this vulnerability. (TALOS-2017-0499,\nCVE-2017-14450)\n\nAn exploitable information disclosure vulnerability exists in the PCX\nimage rendering functionality of SDL2_image-2.0.2. A specially crafted\nPCX image can cause an out-of-bounds read on the heap, resulting in\ninformation disclosure. An attacker can display a specially crafted\nimage to trigger this vulnerability. (TALOS-2018-0519, CVE-2018-3837)\n\nAn exploitable information vulnerability exists in the XCF image\nrendering functionality of SDL2_image-2.0.2. A specially crafted XCF\nimage can cause an out-of-bounds read on the heap, resulting in\ninformation disclosure. An attacker can display a specially crafted\nimage to trigger this vulnerability. (TALOS-2018-0520, CVE-2018-3838)\n\nAn exploitable code execution vulnerability exists in the XCF image\nrendering functionality of SDL2_image-2.0.2. A specially crafted XCF\nimage can cause an out-of-bounds write on the heap, resulting in code\nexecution. An attacker can display a specially crafted image to trigger\nthis vulnerability. (TALOS-2018-0521, CVE-2018-3839)\n\nAn exploitable code execution vulnerability exists in the XCF image\nrendering functionality of SDL2_image-2.0.3. A specially crafted XCF\nimage can cause a heap overflow, resulting in code execution. An\nattacker can display a specially crafted image to trigger this\nvulnerability. (TALOS-2018-0645, CVE-2018-3977)\n","status":"published","published":"2018-11-17T22:23:26Z","modified":"2026-04-16T06:23:47.754880571Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:10608-1","title":"libSDL2_image-2_0-0-2.0.5-1.14 on GA media","description":"These are all security issues fixed in the libSDL2_image-2_0-0-2.0.5-1.14 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:03:33.673961Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:3657-1","title":"Security update for SDL_image","description":"This update for SDL_image fixes the following issues:\n\n- CVE-2017-14442: A specially crafted BMP image could have caused a stack overflow for an attacker that can display a specially crafted image (bsc#1084304).\n- CVE-2017-14450: A specially crafted GIF image could have caused a buffer overflow on a global section for an attacker that can display an image (bsc#1084288).\n- CVE-2017-12122: An exploitable code execution vulnerability exists in the ILBM image rendering functionality. A specially crafted ILBM image can cause a heap overflow resulting in code execution. (bsc#1084256).\n- CVE-2017-14440: An exploitable code execution vulnerability exists in the ILBM image rendering functionality. A specially crafted ILBM image can cause a stack overflow resulting in code execution. (bsc#1084257).\n- CVE-2017-14448: An exploitable code execution vulnerability exists in the XCF image rendering functionality. A specially crafted XCF image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (bsc#1084303).\n- CVE-2018-3839: An exploitable code execution vulnerability exists in the XCF image rendering functionality. A specially crafted XCF image can cause an out-of-bounds write on the heap, resulting in code execution. (bsc#1089087).\n\n","status":"published","published":"2018-11-07T15:19:23Z","modified":"2026-02-04T03:03:42.312573Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}