{"id":"CVE-2019-7575","aliases":["ALPINE-CVE-2019-7575","BELL-CVE-2019-7575","DEBIAN-CVE-2019-7575","DLA-1713-1","DLA-1714-1","DLA-2536-1","DLA-2804-1","DLA-3314-1","EUVD-2019-17113","GHSA-w5hp-3474-hq4r","MGASA-2019-0127","MGASA-2019-0239","OESA-2021-1426","RHSA-2020:3868","RHSA-2020:4627","SUSE-SU-2019:0899-1","SUSE-SU-2019:0917-1","SUSE-SU-2019:0950-1","SUSE-SU-2019:13998-1","UBUNTU-CVE-2019-7575","USN-4156-1","USN-4156-2","openSUSE-SU-2019:1223-1","openSUSE-SU-2019:1261-1","openSUSE-SU-2024:10606-1","openSUSE-SU-2024:13582-1","openSUSE-SU-2025:15205-1","openSUSE-SU-2025:15206-1"],"status":"published","title":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer...","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02942,"percentile":0.87229,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2019-02-07T00:00:00Z","modified":"2026-11-03T06:32:35Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"sdl","fixed_in":["1.2.15-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"sdl","fixed_in":["1.2.15-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"sdl","fixed_in":["1.2.15-r10"],"sources":["osv"]},{"ecosystem":"Alpine:v3.10","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libsdl1.2","fixed_in":["1.2.15+dfsg2-5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libsdl2","fixed_in":["2.0.10+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libsdl2","fixed_in":["2.0.10+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libsdl2","fixed_in":["2.0.10+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl1.2","fixed_in":["1.2.15-8ubuntu1.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl2","fixed_in":["2.0.2+dfsg1-3ubuntu1.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libsdl1.2","fixed_in":["1.2.15+dfsg1-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libsdl1.2","fixed_in":["1.2.15+dfsg2-0.1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r10"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg2-5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-10+deb8u1"}]}],"versions":["1.2.15-10"],"bundled":11},{"source":"osv","ecosystem":"Debian:8","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2+dfsg1-6+deb8u1"}]}],"versions":["2.0.2+dfsg1-6"],"bundled":11},{"source":"osv","ecosystem":"Debian:9","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5+dfsg1-2+deb9u1"}]}],"versions":["2.0.5+dfsg1-2"],"bundled":9},{"source":"osv","ecosystem":"Debian:9","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg1-4+deb9u1"}]}],"versions":["1.2.15+dfsg1-4"],"bundled":12},{"source":"osv","ecosystem":"Debian:10","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9+dfsg1-1+deb10u1"}]}],"versions":["2.0.9+dfsg1-1"],"bundled":16},{"source":"osv","ecosystem":"Mageia:6","package":"SDL12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-19.1.mga6"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:6","package":"mingw-SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-8.1.mga6"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:6","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1.mga6"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:6","package":"mingw-SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1.mga6"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:7","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1.mga7"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:7","package":"mingw-SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1.mga7"}]}],"bundled":12},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-39.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-39.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"SDL-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"SDL-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"SDL-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"SDL-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"SDL-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"SDL-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"SDL-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"SDL-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"SDL-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"SDL-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"SDL-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"SDL-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-38.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"SDL-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-38.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"SDL-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-38.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"SDL-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-38.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-3.9.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-3.9.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-106.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-106.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-106.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-106.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-8ubuntu1.1+esm1"}]}],"versions":["1.2.15-5ubuntu2","1.2.15-5ubuntu3","1.2.15-8ubuntu1","1.2.15-8ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2+dfsg1-3ubuntu1.3+esm1"}]}],"versions":["2.0.0+dfsg1-2","2.0.0+dfsg1-3","2.0.1+dfsg1-1","2.0.1+dfsg1-1ubuntu1","2.0.2+dfsg1-3","2.0.2+dfsg1-3ubuntu1","2.0.2+dfsg1-3ubuntu1.1","2.0.2+dfsg1-3ubuntu1.2","2.0.2+dfsg1-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg1-3ubuntu0.1"}]}],"versions":["1.2.15-11ubuntu1","1.2.15-12ubuntu1","1.2.15+dfsg1-3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.2+dfsg1-6ubuntu2","2.0.4+dfsg1-2","2.0.4+dfsg1-2ubuntu1","2.0.4+dfsg1-2ubuntu2","2.0.4+dfsg1-2ubuntu2.16.04.1","2.0.4+dfsg1-2ubuntu2.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg2-0.1ubuntu0.1"}]}],"versions":["1.2.15+dfsg2-0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.6+dfsg1-3ubuntu1","2.0.6+dfsg1-4ubuntu1","2.0.7+dfsg1-3ubuntu1","2.0.8+dfsg1-1ubuntu1","2.0.8+dfsg1-1ubuntu1.18.04.1","2.0.8+dfsg1-1ubuntu1.18.04.3","2.0.8+dfsg1-1ubuntu1.18.04.4","2.0.8+dfsg1-1ubuntu1.18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg1-3ubuntu0.1"}]}],"versions":["1.2.15-11ubuntu1","1.2.15-12ubuntu1","1.2.15+dfsg1-3"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg2-0.1ubuntu0.1"}]}],"versions":["1.2.15+dfsg2-0.1"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-8ubuntu1.1+esm1"}]}],"versions":["1.2.15-5ubuntu2","1.2.15-5ubuntu3","1.2.15-8ubuntu1","1.2.15-8ubuntu1.1"],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-lp150.2.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-lp150.2.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.5-2.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-1.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.8-1.1"}]}],"bundled":17}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libsdl","product":"simple_directmedia_layer"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00016.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00015.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://bugzilla.libsdl.org/show_bug.cgi?id=4493","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://discourse.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720","tags":["x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201909-07","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4156-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4156-2/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00021.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00020.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00024.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00032.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202305-17","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7575","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/"},{"url":"https://github.com/advisories/GHSA-w5hp-3474-hq4r"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-7575","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-7575","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-7575","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0127.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24496","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OHEXXGCOKNICFBDMNVYYDTSDLQ42K5G5/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2019-0239.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24497","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13616","tags":["advisory"]},{"url":"https://hg.libsdl.org/SDL/file/bc90ce38f1e2/WhatsNew.txt","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1426","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7572","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7574","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3868","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676509","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676743","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676749","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676751","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676755","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676781","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677158","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3868.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7572","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7572","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7573","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7573","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7573","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7574","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7574","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7575","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7575","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7576","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7576","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7576","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7577","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7578","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7578","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7578","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7635","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7635","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7635","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7636","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7636","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7636","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7637","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7637","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7638","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7638","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7638","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4627","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4627.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190899-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1124799","tags":["report"]},{"url":"https://bugzilla.suse.com/1124800","tags":["report"]},{"url":"https://bugzilla.suse.com/1124802","tags":["report"]},{"url":"https://bugzilla.suse.com/1124803","tags":["report"]},{"url":"https://bugzilla.suse.com/1124805","tags":["report"]},{"url":"https://bugzilla.suse.com/1124806","tags":["report"]},{"url":"https://bugzilla.suse.com/1124824","tags":["report"]},{"url":"https://bugzilla.suse.com/1124825","tags":["report"]},{"url":"https://bugzilla.suse.com/1124826","tags":["report"]},{"url":"https://bugzilla.suse.com/1124827","tags":["report"]},{"url":"https://bugzilla.suse.com/1125099","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7638","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190917-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190950-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201913998-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-7575","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4156-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4156-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-7572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7573","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7574","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7635","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7636","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7637","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7638","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13616","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PVVNKCWJ5RBDOAJTNQX6VN77H27KTKSW/#PVVNKCWJ5RBDOAJTNQX6VN77H27KTKSW","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MSOTDS52YKZL25TU3JHV22PWUVFQ6U5U/#MSOTDS52YKZL25TU3JHV22PWUVFQ6U5U","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-4743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13626","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-7575","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.","status":"published","published":"2019-02-07T00:00:00Z","modified":"2024-08-04T20:54:27.839Z","updated_at":"2026-11-02T14:32:22.854093Z"}],"euvd":[{"id":"EUVD-2019-17113","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.","status":"published","published":"2019-02-07T00:00:00Z","modified":"2024-08-04T20:54:27Z","updated_at":"2026-11-03T03:06:45.961014Z"}],"ghsa":[{"id":"GHSA-w5hp-3474-hq4r","title":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer...","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.","status":"published","published":"2022-05-13T01:04:46Z","modified":"2023-05-12T05:00:27Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:54:35.04449Z"}],"nvd":[{"id":"CVE-2019-7575","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.","status":"published","published":"2019-02-07T07:29:00.863Z","modified":"2026-06-17T02:40:43.233Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:05:04.689371Z"}],"osv":[{"id":"ALPINE-CVE-2019-7575","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.","status":"published","published":"2019-02-07T07:29:00.863Z","modified":"2026-11-03T06:32:35.483185584Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"BELL-CVE-2019-7575","title":"CVE-2019-7575 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:31.410374Z","modified":"2026-01-26T09:49:25.907561Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-7575","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.","status":"published","published":"2019-02-07T07:29:00.863Z","modified":"2026-10-24T10:31:01.960370886Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"DEBIAN-CVE-2019-7575","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.","status":"published","published":"2019-02-07T07:29:00.863Z","modified":"2026-09-21T07:03:23.569763517Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"OESA-2021-1426","title":"SDL security update","description":"Simple DirectMedia Layer(SDL) is a cross-platform development library designed\\ to provide low level access to audio, keyboard, mouse, joystick, and graphics\\ hardware via OpenGL and Direct3D. It is used by video playback software, emulators,\\ and popular games including Valve\u0026apos;s award winning catalog and many Humble Bundle games.\\\r\n\r\nSecurity Fix(es):\r\n\r\nSDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(CVE-2019-7572)\r\n\r\nSDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c.(CVE-2019-7574)\r\n\r\nSDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.(CVE-2019-7575)","status":"published","published":"2021-11-12T11:04:41Z","modified":"2026-08-18T01:16:10.412282459Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2020:3868","title":"Red Hat Security Advisory: SDL security update","status":"published","published":"2024-09-16T03:34:09Z","modified":"2026-06-26T10:50:10Z","cvss":[{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:4627","title":"Red Hat Security Advisory: SDL security update","status":"published","published":"2024-09-16T03:34:17Z","modified":"2026-01-14T11:02:55.694089Z","cvss":[{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2019-7575","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.","status":"published","published":"2019-02-07T07:29:00Z","modified":"2026-04-22T12:14:15.88433Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"DLA-1713-1","title":"libsdl1.2 - security update","status":"published","published":"2019-03-13T00:00:00Z","modified":"2026-03-09T01:19:51.755742Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-1714-1","title":"libsdl2 - security update","status":"published","published":"2019-03-13T00:00:00Z","modified":"2026-03-09T01:20:20.726517Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2536-1","title":"libsdl2 - security update","status":"published","published":"2021-01-30T00:00:00Z","modified":"2026-03-09T01:18:31.048555Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-2804-1","title":"libsdl1.2 - security update","status":"published","published":"2021-10-31T00:00:00Z","modified":"2026-03-09T01:22:59.700826Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3314-1","title":"libsdl2 - security update","status":"published","published":"2023-02-09T00:00:00Z","modified":"2026-03-09T01:21:53.582533Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2019-0127","title":"Updated SDL12 packages fix security vulnerability","description":"This release fixes various buffer overflows when parsing or processing\ndamaged Waveform audio and BMP image files.\n- Fix CVE-2019-7577 (a buffer overread in MS_ADPCM_decode) (rhbz#1676510)\n- Fix CVE-2019-7575 (a buffer overwrite in MS_ADPCM_decode) (rhbz#1676744)\n- Fix CVE-2019-7574 (a buffer overread in IMA_ADPCM_decode) (rhbz#1676750)\n- Fix CVE-2019-7572 (a buffer overread in IMA_ADPCM_nibble) (rhbz#1676754)\n- Fix CVE-2019-7572 (a buffer overwrite in IMA_ADPCM_nibble) (rhbz#1676754)\n- Fix CVE-2019-7573, CVE-2019-7576 (buffer overreads in InitMS_ADPCM)\n  (rhbz#1676752, rhbz#1676756)\n- Fix CVE-2019-7578 (a buffer overread in InitIMA_ADPCM) (rhbz#1676782)\n- Fix CVE-2019-7638, CVE-2019-7636 (buffer overflows when processing BMP\n  images with too high number of colors) (rhbz#1677144, rhbz#1677157)\n- Fix CVE-2019-7637 (an integer overflow in SDL_CalculatePitch)\n  (rhbz#1677152)\n- Fix CVE-2019-7635 (a buffer overread when blitting a BMP image with pixel\n  colors out the palette) (rhbz#1677159)\n- Reject 2, 3, 5, 6, 7-bpp BMP images (rhbz#1677159)\n","status":"published","published":"2019-04-05T18:12:59Z","modified":"2026-04-16T04:41:39.566471751Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2019-0239","title":"Updated sdl2 packages fix security vulnerabilities","description":"Updated sdl2 packages fix security vulnerabilities\n\nThis release fixes various buffer overflows when parsing or processing\ndamaged Waveform audio and BMP image files.\n\n- Fix CVE-2019-7572 (a buffer overread in IMA_ADPCM_nibble) (rhbz#1676754)\n- Fix CVE-2019-7572 (a buffer overwrite in IMA_ADPCM_nibble) (rhbz#1676754)\n- Fix CVE-2019-7573, CVE-2019-7576 (buffer overreads in InitMS_ADPCM)\n  (rhbz#1676752, rhbz#1676756)\n- Fix CVE-2019-7574 (a buffer overread in IMA_ADPCM_decode) (rhbz#1676750)\n- Fix CVE-2019-7575 (a buffer overwrite in MS_ADPCM_decode) (rhbz#1676744)\n- Fix CVE-2019-7577 (a buffer overread in MS_ADPCM_decode) (rhbz#1676510)\n- Fix CVE-2019-7578 (a buffer overread in InitIMA_ADPCM) (rhbz#1676782)\n- Fix CVE-2019-7635 (a buffer overread when blitting a BMP image with pixel\n  colors out the palette) (rhbz#1677159)\n- Fix CVE-2019-7636, CVE-2019-7638 (buffer overflows when processing BMP\n  images with too high number of colors) (rhbz#1677144, rhbz#1677157)\n- Fix CVE-2019-7637 (an integer overflow in SDL_CalculatePitch)\n  (rhbz#1677152)\n- Reject 2, 3, 5, 6, 7-bpp BMP images (rhbz#1677159)\n- Fix CVE-2010-13616 (heap-based buffer over-read in BlitNtoN in\n  video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c)\n\nThe 2.0.10 release also provides various features and bug fixes.\n","status":"published","published":"2019-09-06T21:09:08Z","modified":"2026-04-16T06:25:16.293559732Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1223-1","title":"Security update for SDL","description":"This update for SDL fixes the following issues:\n\nSecurity issues fixed:\t  \n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-17T13:29:07Z","modified":"2025-05-02T04:30:19.611361Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1261-1","title":"Security update for SDL2","description":"This update for SDL2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-23T15:07:46Z","modified":"2026-02-04T02:29:31.23932Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10606-1","title":"libSDL-1_2-0-1.2.15-22.13 on GA media","description":"These are all security issues fixed in the libSDL-1_2-0-1.2.15-22.13 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:22:08.154225Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:13582-1","title":"SDL2-devel-2.28.5-2.1 on GA media","description":"These are all security issues fixed in the SDL2-devel-2.28.5-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:30:21.570358Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2025:15205-1","title":"SDL-1.2.15-1.1 on GA media","description":"These are all security issues fixed in the SDL-1.2.15-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:29.841137Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15206-1","title":"SDL2-2.32.8-1.1 on GA media","description":"These are all security issues fixed in the SDL2-2.32.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:29.880873Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2019:0899-1","title":"Security update for SDL","description":"This update for SDL fixes the following issues:\n\t  \nSecurity issues fixed:\t  \n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800). \n","status":"published","published":"2019-04-08T09:10:07Z","modified":"2026-02-04T03:23:45.255875Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0917-1","title":"Security update for SDL","description":"This update for SDL fixes the following issues:\n\nSecurity issues fixed:\t  \n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).\n","status":"published","published":"2019-04-09T11:08:17Z","modified":"2026-02-04T04:34:14.234453Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0950-1","title":"Security update for SDL2","description":"This update for SDL2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).\n","status":"published","published":"2019-04-15T09:56:40Z","modified":"2026-02-04T04:38:41.109854Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:13998-1","title":"Security update for SDL","description":"This update for SDL fixes the following issues:\n\nSecurity issues fixed:\t  \n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\t  \n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).\n","status":"published","published":"2019-03-29T15:33:20Z","modified":"2026-02-04T03:05:32.340362Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-4156-1","title":"libsdl1.2 vulnerabilities","description":"It was discovered that SDL incorrectly handled certain images. If a user\nwere tricked into opening a crafted image file, a remote attacker could\nuse this issue to cause SDL to crash, resulting in a denial of service, or\npossibly execute arbitrary code.\n","status":"published","published":"2019-10-15T18:27:06Z","modified":"2026-04-27T15:33:07.371481362Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4156-2","title":"libsdl1.2 vulnerabilities","description":"USN-4156-1 fixed several vulnerabilities in SDL. This update provides\nthe corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that SDL incorrectly handled certain images. If a user\n were tricked into opening a crafted image file, a remote attacker could\n use this issue to cause SDL to crash, resulting in a denial of service, or\n possibly execute arbitary code.\n","status":"published","published":"2019-10-16T14:21:02Z","modified":"2026-04-27T15:33:07.150217963Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}