{"id":"CVE-2019-7578","aliases":["ALPINE-CVE-2019-7578","BELL-CVE-2019-7578","DEBIAN-CVE-2019-7578","DLA-1713-1","DLA-1714-1","DLA-2536-1","DLA-2804-1","DLA-3314-1","EUVD-2019-17116","GHSA-cqvj-4v3p-qxcr","MGASA-2019-0239","RHSA-2020:3868","RHSA-2020:4627","SUSE-SU-2019:0899-1","SUSE-SU-2019:0917-1","SUSE-SU-2019:0950-1","SUSE-SU-2019:13998-1","UBUNTU-CVE-2019-7578","USN-4156-1","USN-4156-2","openSUSE-SU-2019:1223-1","openSUSE-SU-2019:1261-1","openSUSE-SU-2024:10606-1","openSUSE-SU-2024:13582-1","openSUSE-SU-2025:15205-1","openSUSE-SU-2025:15206-1"],"status":"published","title":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over...","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02922,"percentile":0.87139,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2019-02-07T00:00:00Z","modified":"2026-11-03T06:32:19Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"sdl","fixed_in":["1.2.15-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"sdl","fixed_in":["1.2.15-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"sdl","fixed_in":["1.2.15-r10"],"sources":["osv"]},{"ecosystem":"Alpine:v3.10","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libsdl1.2","fixed_in":["1.2.15+dfsg2-5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libsdl2","fixed_in":["2.0.10+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libsdl2","fixed_in":["2.0.10+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libsdl2","fixed_in":["2.0.10+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl1.2","fixed_in":["1.2.15-8ubuntu1.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl2","fixed_in":["2.0.2+dfsg1-3ubuntu1.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libsdl1.2","fixed_in":["1.2.15+dfsg1-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libsdl1.2","fixed_in":["1.2.15+dfsg2-0.1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r10"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg2-5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-10+deb8u1"}]}],"versions":["1.2.15-10"],"bundled":11},{"source":"osv","ecosystem":"Debian:8","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2+dfsg1-6+deb8u1"}]}],"versions":["2.0.2+dfsg1-6"],"bundled":11},{"source":"osv","ecosystem":"Debian:9","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5+dfsg1-2+deb9u1"}]}],"versions":["2.0.5+dfsg1-2"],"bundled":9},{"source":"osv","ecosystem":"Debian:9","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg1-4+deb9u1"}]}],"versions":["1.2.15+dfsg1-4"],"bundled":12},{"source":"osv","ecosystem":"Debian:10","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9+dfsg1-1+deb10u1"}]}],"versions":["2.0.9+dfsg1-1"],"bundled":16},{"source":"osv","ecosystem":"Mageia:6","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1.mga6"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:6","package":"mingw-SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1.mga6"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:7","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1.mga7"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:7","package":"mingw-SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1.mga7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"SDL-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"SDL-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"SDL-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"SDL-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"SDL-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"SDL-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"SDL-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"SDL-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"SDL-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"SDL-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"SDL-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"SDL-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-38.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"SDL-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-38.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"SDL-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-38.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"SDL-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-38.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-3.9.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-3.9.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-106.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-106.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-106.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-106.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-8ubuntu1.1+esm1"}]}],"versions":["1.2.15-5ubuntu2","1.2.15-5ubuntu3","1.2.15-8ubuntu1","1.2.15-8ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2+dfsg1-3ubuntu1.3+esm1"}]}],"versions":["2.0.0+dfsg1-2","2.0.0+dfsg1-3","2.0.1+dfsg1-1","2.0.1+dfsg1-1ubuntu1","2.0.2+dfsg1-3","2.0.2+dfsg1-3ubuntu1","2.0.2+dfsg1-3ubuntu1.1","2.0.2+dfsg1-3ubuntu1.2","2.0.2+dfsg1-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg1-3ubuntu0.1"}]}],"versions":["1.2.15-11ubuntu1","1.2.15-12ubuntu1","1.2.15+dfsg1-3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.2+dfsg1-6ubuntu2","2.0.4+dfsg1-2","2.0.4+dfsg1-2ubuntu1","2.0.4+dfsg1-2ubuntu2","2.0.4+dfsg1-2ubuntu2.16.04.1","2.0.4+dfsg1-2ubuntu2.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg2-0.1ubuntu0.1"}]}],"versions":["1.2.15+dfsg2-0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.6+dfsg1-3ubuntu1","2.0.6+dfsg1-4ubuntu1","2.0.7+dfsg1-3ubuntu1","2.0.8+dfsg1-1ubuntu1","2.0.8+dfsg1-1ubuntu1.18.04.1","2.0.8+dfsg1-1ubuntu1.18.04.3","2.0.8+dfsg1-1ubuntu1.18.04.4","2.0.8+dfsg1-1ubuntu1.18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg1-3ubuntu0.1"}]}],"versions":["1.2.15-11ubuntu1","1.2.15-12ubuntu1","1.2.15+dfsg1-3"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg2-0.1ubuntu0.1"}]}],"versions":["1.2.15+dfsg2-0.1"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-8ubuntu1.1+esm1"}]}],"versions":["1.2.15-5ubuntu2","1.2.15-5ubuntu3","1.2.15-8ubuntu1","1.2.15-8ubuntu1.1"],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-lp150.2.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-lp150.2.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.5-2.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-1.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.8-1.1"}]}],"bundled":17}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libsdl","product":"simple_directmedia_layer"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00016.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00015.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://bugzilla.libsdl.org/show_bug.cgi?id=4494","tags":["x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory","fix"]},{"url":"https://discourse.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720","tags":["x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201909-07","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4156-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4156-2/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00021.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00020.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00024.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00032.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202305-17","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7578","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/"},{"url":"https://github.com/advisories/GHSA-cqvj-4v3p-qxcr"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-7578","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-7578","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-7578","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0239.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24497","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OHEXXGCOKNICFBDMNVYYDTSDLQ42K5G5/","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13616","tags":["advisory"]},{"url":"https://hg.libsdl.org/SDL/file/bc90ce38f1e2/WhatsNew.txt","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3868","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676509","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676743","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676749","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676751","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676755","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676781","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677158","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3868.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7572","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7572","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7572","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7573","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7573","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7573","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7574","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7574","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7574","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7575","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7575","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7575","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7576","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7576","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7576","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7577","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7578","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7578","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7635","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7635","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7635","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7636","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7636","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7636","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7637","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7637","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7638","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7638","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7638","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4627","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4627.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190899-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1124799","tags":["report"]},{"url":"https://bugzilla.suse.com/1124800","tags":["report"]},{"url":"https://bugzilla.suse.com/1124802","tags":["report"]},{"url":"https://bugzilla.suse.com/1124803","tags":["report"]},{"url":"https://bugzilla.suse.com/1124805","tags":["report"]},{"url":"https://bugzilla.suse.com/1124806","tags":["report"]},{"url":"https://bugzilla.suse.com/1124824","tags":["report"]},{"url":"https://bugzilla.suse.com/1124825","tags":["report"]},{"url":"https://bugzilla.suse.com/1124826","tags":["report"]},{"url":"https://bugzilla.suse.com/1124827","tags":["report"]},{"url":"https://bugzilla.suse.com/1125099","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7638","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190917-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190950-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201913998-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-7578","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4156-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4156-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-7572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7573","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7574","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7575","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7635","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7636","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7637","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7638","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13616","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PVVNKCWJ5RBDOAJTNQX6VN77H27KTKSW/#PVVNKCWJ5RBDOAJTNQX6VN77H27KTKSW","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MSOTDS52YKZL25TU3JHV22PWUVFQ6U5U/#MSOTDS52YKZL25TU3JHV22PWUVFQ6U5U","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-4743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13626","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-7578","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.","status":"published","published":"2019-02-07T00:00:00Z","modified":"2024-08-04T20:54:28.373Z","updated_at":"2026-11-02T14:32:22.432545Z"}],"euvd":[{"id":"EUVD-2019-17116","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.","status":"published","published":"2019-02-07T00:00:00Z","modified":"2024-08-04T20:54:28Z","updated_at":"2026-11-03T03:06:45.52347Z"}],"ghsa":[{"id":"GHSA-cqvj-4v3p-qxcr","title":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over...","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.","status":"published","published":"2022-05-13T01:04:45Z","modified":"2023-05-03T12:30:22Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:54:34.500941Z"}],"nvd":[{"id":"CVE-2019-7578","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.","status":"published","published":"2019-02-07T07:29:01.037Z","modified":"2026-06-17T02:40:43.7Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:04.689371Z"}],"osv":[{"id":"ALPINE-CVE-2019-7578","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.","status":"published","published":"2019-02-07T07:29:01.037Z","modified":"2026-11-03T06:32:19.688104651Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"BELL-CVE-2019-7578","title":"CVE-2019-7578 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:58.47255Z","modified":"2026-01-26T09:48:56.028997Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-7578","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.","status":"published","published":"2019-02-07T07:29:01.037Z","modified":"2026-10-24T10:30:28.00559369Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"DEBIAN-CVE-2019-7578","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.","status":"published","published":"2019-02-07T07:29:01.037Z","modified":"2026-09-21T07:03:15.619408651Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"RHSA-2020:3868","title":"Red Hat Security Advisory: SDL security update","status":"published","published":"2024-09-16T03:34:09Z","modified":"2026-06-26T10:50:10Z","cvss":[{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:4627","title":"Red Hat Security Advisory: SDL security update","status":"published","published":"2024-09-16T03:34:17Z","modified":"2026-01-14T11:02:55.694089Z","cvss":[{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2019-7578","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.","status":"published","published":"2019-02-07T07:29:00Z","modified":"2026-04-22T12:21:29.477051Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"DLA-1713-1","title":"libsdl1.2 - security update","status":"published","published":"2019-03-13T00:00:00Z","modified":"2026-03-09T01:19:51.755742Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-1714-1","title":"libsdl2 - security update","status":"published","published":"2019-03-13T00:00:00Z","modified":"2026-03-09T01:20:20.726517Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2536-1","title":"libsdl2 - security update","status":"published","published":"2021-01-30T00:00:00Z","modified":"2026-03-09T01:18:31.048555Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-2804-1","title":"libsdl1.2 - security update","status":"published","published":"2021-10-31T00:00:00Z","modified":"2026-03-09T01:22:59.700826Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3314-1","title":"libsdl2 - security update","status":"published","published":"2023-02-09T00:00:00Z","modified":"2026-03-09T01:21:53.582533Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2019-0239","title":"Updated sdl2 packages fix security vulnerabilities","description":"Updated sdl2 packages fix security vulnerabilities\n\nThis release fixes various buffer overflows when parsing or processing\ndamaged Waveform audio and BMP image files.\n\n- Fix CVE-2019-7572 (a buffer overread in IMA_ADPCM_nibble) (rhbz#1676754)\n- Fix CVE-2019-7572 (a buffer overwrite in IMA_ADPCM_nibble) (rhbz#1676754)\n- Fix CVE-2019-7573, CVE-2019-7576 (buffer overreads in InitMS_ADPCM)\n  (rhbz#1676752, rhbz#1676756)\n- Fix CVE-2019-7574 (a buffer overread in IMA_ADPCM_decode) (rhbz#1676750)\n- Fix CVE-2019-7575 (a buffer overwrite in MS_ADPCM_decode) (rhbz#1676744)\n- Fix CVE-2019-7577 (a buffer overread in MS_ADPCM_decode) (rhbz#1676510)\n- Fix CVE-2019-7578 (a buffer overread in InitIMA_ADPCM) (rhbz#1676782)\n- Fix CVE-2019-7635 (a buffer overread when blitting a BMP image with pixel\n  colors out the palette) (rhbz#1677159)\n- Fix CVE-2019-7636, CVE-2019-7638 (buffer overflows when processing BMP\n  images with too high number of colors) (rhbz#1677144, rhbz#1677157)\n- Fix CVE-2019-7637 (an integer overflow in SDL_CalculatePitch)\n  (rhbz#1677152)\n- Reject 2, 3, 5, 6, 7-bpp BMP images (rhbz#1677159)\n- Fix CVE-2010-13616 (heap-based buffer over-read in BlitNtoN in\n  video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c)\n\nThe 2.0.10 release also provides various features and bug fixes.\n","status":"published","published":"2019-09-06T21:09:08Z","modified":"2026-04-16T06:25:16.293559732Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1223-1","title":"Security update for SDL","description":"This update for SDL fixes the following issues:\n\nSecurity issues fixed:\t  \n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-17T13:29:07Z","modified":"2025-05-02T04:30:19.611361Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1261-1","title":"Security update for SDL2","description":"This update for SDL2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-23T15:07:46Z","modified":"2026-02-04T02:29:31.23932Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10606-1","title":"libSDL-1_2-0-1.2.15-22.13 on GA media","description":"These are all security issues fixed in the libSDL-1_2-0-1.2.15-22.13 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:22:08.154225Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:13582-1","title":"SDL2-devel-2.28.5-2.1 on GA media","description":"These are all security issues fixed in the SDL2-devel-2.28.5-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:30:21.570358Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2025:15205-1","title":"SDL-1.2.15-1.1 on GA media","description":"These are all security issues fixed in the SDL-1.2.15-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:29.841137Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15206-1","title":"SDL2-2.32.8-1.1 on GA media","description":"These are all security issues fixed in the SDL2-2.32.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:29.880873Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2019:0899-1","title":"Security update for SDL","description":"This update for SDL fixes the following issues:\n\t  \nSecurity issues fixed:\t  \n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800). \n","status":"published","published":"2019-04-08T09:10:07Z","modified":"2026-02-04T03:23:45.255875Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0917-1","title":"Security update for SDL","description":"This update for SDL fixes the following issues:\n\nSecurity issues fixed:\t  \n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).\n","status":"published","published":"2019-04-09T11:08:17Z","modified":"2026-02-04T04:34:14.234453Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0950-1","title":"Security update for SDL2","description":"This update for SDL2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).\n","status":"published","published":"2019-04-15T09:56:40Z","modified":"2026-02-04T04:38:41.109854Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:13998-1","title":"Security update for SDL","description":"This update for SDL fixes the following issues:\n\nSecurity issues fixed:\t  \n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\t  \n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).\n","status":"published","published":"2019-03-29T15:33:20Z","modified":"2026-02-04T03:05:32.340362Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-4156-1","title":"libsdl1.2 vulnerabilities","description":"It was discovered that SDL incorrectly handled certain images. If a user\nwere tricked into opening a crafted image file, a remote attacker could\nuse this issue to cause SDL to crash, resulting in a denial of service, or\npossibly execute arbitrary code.\n","status":"published","published":"2019-10-15T18:27:06Z","modified":"2026-04-27T15:33:07.371481362Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4156-2","title":"libsdl1.2 vulnerabilities","description":"USN-4156-1 fixed several vulnerabilities in SDL. This update provides\nthe corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that SDL incorrectly handled certain images. If a user\n were tricked into opening a crafted image file, a remote attacker could\n use this issue to cause SDL to crash, resulting in a denial of service, or\n possibly execute arbitary code.\n","status":"published","published":"2019-10-16T14:21:02Z","modified":"2026-04-27T15:33:07.150217963Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}