{"id":"CVE-2017-14441","aliases":["ALPINE-CVE-2017-14441","DEBIAN-CVE-2017-14441","DLA-1341-1","DSA-4177-1","DSA-4184-1","EUVD-2017-5944","GHSA-fjmx-7p86-hg32","MGASA-2018-0276","MGASA-2018-0454","UBUNTU-CVE-2017-14441","openSUSE-SU-2024:10608-1"],"status":"published","title":"An exploitable code execution vulnerability exists in the ICO image rendering functionality of...","description":"An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2.0.2. A specially crafted ICO image can cause an integer overflow, cascading to a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02627,"percentile":0.85604,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2018-04-06T00:00:00Z","modified":"2026-09-01T20:03:44Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"sdl2_image","fixed_in":["2.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"sdl2_image","fixed_in":["2.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"sdl2_image","fixed_in":["2.0.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"sdl2_image","fixed_in":["2.0.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"sdl2_image","fixed_in":["2.0.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"sdl2_image","fixed_in":["2.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"sdl2_image","fixed_in":["2.0.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libsdl2-image","fixed_in":["2.0.3+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libsdl2-image","fixed_in":["2.0.3+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libsdl2-image","fixed_in":["2.0.3+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"sdl-image1.2","fixed_in":["1.2.12-8"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sdl-image1.2","fixed_in":["1.2.12-8"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sdl-image1.2","fixed_in":["1.2.12-8"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libsdl2-image","fixed_in":["2.0.0+dfsg-3+deb8u1build0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"sdl-image1.2","fixed_in":["1.2.12-5+deb9u1build0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libsdl2-image","fixed_in":["2.0.1+dfsg-2+deb9u1build0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"sdl-image1.2","fixed_in":["1.2.12-5+deb9u1build0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"sdl2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"sdl2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"sdl2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"sdl2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"sdl2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"sdl2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"sdl2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-8"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-8"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-8"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-2+deb7u2"}]}],"versions":["1.2.12-2","1.2.12-2+deb7u1"],"bundled":9},{"source":"osv","ecosystem":"Debian:8","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-3+deb8u1"}]}],"versions":["2.0.0+dfsg-3"],"bundled":11},{"source":"osv","ecosystem":"Debian:9","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1+dfsg-2+deb9u1"}]}],"versions":["2.0.1+dfsg-2"],"bundled":11},{"source":"osv","ecosystem":"Debian:8","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-5+deb8u1"}]}],"versions":["1.2.12-5"],"bundled":10},{"source":"osv","ecosystem":"Debian:9","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-5+deb9u1"}]}],"versions":["1.2.12-5"],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"SDL_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-8.2.mga5"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:6","package":"SDL_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-9.2.mga6"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:6","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-1.mga6"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:6","package":"sdl2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-1.mga6"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:6","package":"sdl2_mixer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-1.mga6"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:6","package":"mingw-SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-1.mga6"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:6","package":"mingw-SDL2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-1.mga6"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:6","package":"mingw-SDL2_mixer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-1.mga6"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-3+deb8u1build0.14.04.1"}]}],"versions":["2.0.0+dfsg-2","2.0.0+dfsg-3","2.0.0+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-5+deb9u1build0.14.04.1"}]}],"versions":["1.2.12-4ubuntu1","1.2.12-5","1.2.12-5build2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1+dfsg-2+deb9u1build0.16.04.1"}]}],"versions":["2.0.0+dfsg-3build2","2.0.1+dfsg-1","2.0.1+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-5+deb9u1build0.16.04.1"}]}],"versions":["1.2.12-5build2"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"libsdl","product":"sdl_image"},{"vendor":"sam lantinga and mattias engdegård","product":"simple directmedia layer"},{"vendor":"simple directmedia layer","product":"simple directmedia layer"}],"references":[{"url":"https://www.debian.org/security/2018/dsa-4177","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00005.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4184","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/201903-17","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0490","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-14441"},{"url":"https://github.com/advisories/GHSA-fjmx-7p86-hg32"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-14441","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-14441","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0276.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22967","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2018-0454.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22769","tags":["report"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0488","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0489","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0490","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0491","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0497","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0498","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0499","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0519","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0520","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0521","tags":["web"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0645","tags":["web"]},{"url":"https://hg.libsdl.org/SDL/file/8feb5da6f2fb/WhatsNew.txt","tags":["web"]},{"url":"https://www.libsdl.org/projects/SDL_image/","tags":["web"]},{"url":"https://www.libsdl.org/projects/SDL_mixer/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-14441","tags":["report"]},{"url":"https://hg.libsdl.org/SDL_image/rev/a1e9b624ca10","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-14441","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5060","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-14441","description":"An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2.0.2. A specially crafted ICO image can cause an integer overflow, cascading to a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","status":"published","published":"2018-04-24T19:00:00Z","modified":"2024-09-17T04:05:12.485Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:33:12.267141Z"}],"euvd":[{"id":"EUVD-2017-5944","description":"An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2.0.2. A specially crafted ICO image can cause an integer overflow, cascading to a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","status":"published","published":"2018-04-24T19:00:00Z","modified":"2024-09-17T04:05:12Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:25.709658Z"}],"ghsa":[{"id":"GHSA-fjmx-7p86-hg32","title":"An exploitable code execution vulnerability exists in the ICO image rendering functionality of...","description":"An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2.0.2. A specially crafted ICO image can cause an integer overflow, cascading to a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","status":"published","published":"2022-05-13T01:01:34Z","modified":"2023-02-02T05:01:22Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:51:10.253822Z"}],"nvd":[{"id":"CVE-2017-14441","description":"An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2.0.2. A specially crafted ICO image can cause an integer overflow, cascading to a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","status":"published","published":"2018-04-24T19:29:01.673Z","modified":"2026-06-17T01:06:09.32Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:04:17.032862Z"}],"osv":[{"id":"ALPINE-CVE-2017-14441","description":"An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2.0.2. A specially crafted ICO image can cause an integer overflow, cascading to a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","status":"published","published":"2018-04-24T19:29:01.673Z","modified":"2026-06-15T18:24:23.612139709Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-14441","description":"An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2.0.2. A specially crafted ICO image can cause an integer overflow, cascading to a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","status":"published","published":"2018-04-24T19:29:01.673Z","modified":"2026-04-16T06:19:21.133708665Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"DEBIAN-CVE-2017-14441","description":"An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2.0.2. A specially crafted ICO image can cause an integer overflow, cascading to a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","status":"published","published":"2018-04-24T19:29:01.673Z","modified":"2026-09-01T20:03:44.083362408Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"UBUNTU-CVE-2017-14441","description":"An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2.0.2. A specially crafted ICO image can cause an integer overflow, cascading to a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.","status":"published","published":"2018-04-24T19:29:00Z","modified":"2026-04-22T11:16:41.55403Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.122973Z"},{"id":"DLA-1341-1","title":"sdl-image1.2 - security update","status":"published","published":"2018-04-06T00:00:00Z","modified":"2026-03-09T01:01:32.25784Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4177-1","title":"libsdl2-image - security update","status":"published","published":"2018-04-20T00:00:00Z","modified":"2026-03-09T01:21:09.761527Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"DSA-4184-1","title":"sdl-image1.2 - security update","status":"published","published":"2018-04-28T00:00:00Z","modified":"2026-03-09T01:19:36.868169Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0276","title":"Updated SDL_image packages fix security vulnerability","description":"Multiple vulnerabilities have been discovered in the image loading library\nfor Simple DirectMedia Layer 1.2, which could result in denial of service\nor the execution of arbitrary code if malformed image files are opened\n(CVE-2017-12122, CVE-2017-14440, CVE-2017-14441, CVE-2017-14442,\nCVE-2017-14448, CVE-2017-14450, CVE-2018-3837, CVE-2018-3838,\nCVE-2018-3839).\n","status":"published","published":"2018-06-06T18:15:31Z","modified":"2026-04-16T06:25:00.687548656Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"MGASA-2018-0454","title":"Updated sdl2/mingw-SDL2 packages fix security vulnerabilities","description":"This update fixes various security vulnerabilities affecting the\nSDL2_image library, listed below. The fixes are provided in SDL2_image\n2.0.4, which depends on SDL2 2.0.8 or later. As such, the SDL2 and\nSDL2_mixer libraries are also updated to their current stable releases,\nproviding various bug fixes and features.\n\nThe security vulnerabilities fixed in this update are the following:\n\nAn exploitable code execution vulnerability exists in the ILBM image\nrendering functionality of SDL2_image-2.0.2. A specially crafted ILBM\nimage can cause a heap overflow resulting in code execution. An attacker\ncan display a specially crafted image to trigger this vulnerability.\n(TALOS-2017-0488, CVE-2017-12122)\n\nAn exploitable code execution vulnerability exists in the ILBM image\nrendering functionality of SDL2_image-2.0.2. A specially crafted ILBM\nimage can cause a stack overflow resulting in code execution. An\nattacker can display a specially crafted image to trigger this\nvulnerability. (TALOS-2017-0489, CVE-2017-14440)\n\nAn exploitable code execution vulnerability exists in the ICO image\nrendering functionality of SDL2_image-2.0.2. A specially crafted ICO\nimage can cause an integer overflow, cascading to a heap overflow\nresulting in code execution. An attacker can display a specially crafted\nimage to trigger this vulnerability. (TALOS-2017-0490, CVE-2017-14441)\n\nAn exploitable code execution vulnerability exists in the BMP image\nrendering functionality of SDL2_image-2.0.2. A specially crafted BMP\nimage can cause a stack overflow resulting in code execution. An\nattacker can display a specially crafted image to trigger this\nvulnerability. (TALOS-2017-0491, CVE-2017-14442)\n\nAn exploitable code execution vulnerability exists in the XCF image\nrendering functionality of SDL2_image-2.0.2. A specially crafted XCF\nimage can cause a heap overflow resulting in code execution. An\nattacker can display a specially crafted image to trigger this\nvulnerability. (TALOS-2017-0497, CVE-2017-14448)\n\nA double-Free vulnerability exists in the XCF image rendering\nfunctionality of SDL2_image-2.0.2. A specially crafted XCF image can\ncause a Double-Free situation to occur. An attacker can display a\nspecially crafted image to trigger this vulnerability.\n(TALOS-2017-0498, CVE-2017-14449)\n\nA buffer overflow vulnerability exists in the GIF image parsing\nfunctionality of SDL2_image-2.0.2. A specially crafted GIF image can\nlead to a buffer overflow on a global section. An attacker can display\nan image to trigger this vulnerability. (TALOS-2017-0499,\nCVE-2017-14450)\n\nAn exploitable information disclosure vulnerability exists in the PCX\nimage rendering functionality of SDL2_image-2.0.2. A specially crafted\nPCX image can cause an out-of-bounds read on the heap, resulting in\ninformation disclosure. An attacker can display a specially crafted\nimage to trigger this vulnerability. (TALOS-2018-0519, CVE-2018-3837)\n\nAn exploitable information vulnerability exists in the XCF image\nrendering functionality of SDL2_image-2.0.2. A specially crafted XCF\nimage can cause an out-of-bounds read on the heap, resulting in\ninformation disclosure. An attacker can display a specially crafted\nimage to trigger this vulnerability. (TALOS-2018-0520, CVE-2018-3838)\n\nAn exploitable code execution vulnerability exists in the XCF image\nrendering functionality of SDL2_image-2.0.2. A specially crafted XCF\nimage can cause an out-of-bounds write on the heap, resulting in code\nexecution. An attacker can display a specially crafted image to trigger\nthis vulnerability. (TALOS-2018-0521, CVE-2018-3839)\n\nAn exploitable code execution vulnerability exists in the XCF image\nrendering functionality of SDL2_image-2.0.3. A specially crafted XCF\nimage can cause a heap overflow, resulting in code execution. An\nattacker can display a specially crafted image to trigger this\nvulnerability. (TALOS-2018-0645, CVE-2018-3977)\n","status":"published","published":"2018-11-17T22:23:26Z","modified":"2026-04-16T06:23:47.754880571Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:10608-1","title":"libSDL2_image-2_0-0-2.0.5-1.14 on GA media","description":"These are all security issues fixed in the libSDL2_image-2_0-0-2.0.5-1.14 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:03:33.673961Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}