{"id":"CVE-2019-7635","aliases":["ALPINE-CVE-2019-7635","BELL-CVE-2019-7635","DEBIAN-CVE-2019-7635","DLA-1713-1","DLA-1714-1","DLA-1861-1","DLA-1865-1","DLA-2536-1","DLA-2804-1","DLA-3314-1","EUVD-2019-17168","GHSA-c83x-cr7v-6qrf","MGASA-2019-0127","MGASA-2019-0239","MGASA-2019-0363","RHSA-2020:3868","RHSA-2020:4627","SUSE-SU-2019:0899-1","SUSE-SU-2019:0917-1","SUSE-SU-2019:0950-1","SUSE-SU-2019:13998-1","UBUNTU-CVE-2019-7635","USN-4143-1","USN-4156-1","USN-4156-2","USN-4238-1","openSUSE-SU-2019:1223-1","openSUSE-SU-2019:1261-1","openSUSE-SU-2019:2071-1","openSUSE-SU-2019:2109-1","openSUSE-SU-2024:10606-1","openSUSE-SU-2024:10607-1","openSUSE-SU-2024:10609-1","openSUSE-SU-2025:15205-1","openSUSE-SU-2025:15206-1"],"status":"published","title":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over...","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03538,"percentile":0.89358,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2019-02-08T00:00:00Z","modified":"2026-11-03T06:31:38Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"sdl","fixed_in":["1.2.15-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"sdl","fixed_in":["1.2.15-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"sdl","fixed_in":["1.2.15-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"sdl","fixed_in":["1.2.15-r10"],"sources":["osv"]},{"ecosystem":"Alpine:v3.10","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"sdl2","fixed_in":["2.0.10-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libsdl1.2","fixed_in":["1.2.15+dfsg2-5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libsdl2","fixed_in":["2.0.10+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libsdl2","fixed_in":["2.0.10+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libsdl2","fixed_in":["2.0.10+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libsdl2-image","fixed_in":["2.0.5+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libsdl2-image","fixed_in":["2.0.5+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libsdl2-image","fixed_in":["2.0.5+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"sdl-image1.2","fixed_in":["1.2.12-11"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sdl-image1.2","fixed_in":["1.2.12-11"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sdl-image1.2","fixed_in":["1.2.12-11"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl1.2","fixed_in":["1.2.15-8ubuntu1.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl2-image","fixed_in":["2.0.0+dfsg-3+deb8u2build0.14.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"sdl-image1.2","fixed_in":["1.2.12-5+deb9u1ubuntu0.14.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libsdl1.2","fixed_in":["1.2.15+dfsg1-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libsdl2","fixed_in":["2.0.4+dfsg1-2ubuntu2.16.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"sdl-image1.2","fixed_in":["1.2.12-5+deb9u1ubuntu0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libsdl1.2","fixed_in":["1.2.15+dfsg2-0.1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libsdl2","fixed_in":["2.0.8+dfsg1-1ubuntu1.18.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"sdl-image1.2","fixed_in":["1.2.12-8ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"sdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-r10"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg2-5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-11"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-11"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-11"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-10+deb8u1"}]}],"versions":["1.2.15-10"],"bundled":11},{"source":"osv","ecosystem":"Debian:8","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2+dfsg1-6+deb8u1"}]}],"versions":["2.0.2+dfsg1-6"],"bundled":11},{"source":"osv","ecosystem":"Debian:8","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-3+deb8u2"}]}],"versions":["2.0.0+dfsg-3","2.0.0+dfsg-3+deb8u1"],"bundled":11},{"source":"osv","ecosystem":"Debian:8","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-5+deb8u2"}]}],"versions":["1.2.12-5","1.2.12-5+deb8u1"],"bundled":11},{"source":"osv","ecosystem":"Debian:9","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5+dfsg1-2+deb9u1"}]}],"versions":["2.0.5+dfsg1-2"],"bundled":9},{"source":"osv","ecosystem":"Debian:9","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg1-4+deb9u1"}]}],"versions":["1.2.15+dfsg1-4"],"bundled":12},{"source":"osv","ecosystem":"Debian:10","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9+dfsg1-1+deb10u1"}]}],"versions":["2.0.9+dfsg1-1"],"bundled":16},{"source":"osv","ecosystem":"Mageia:6","package":"SDL12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-19.1.mga6"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:6","package":"mingw-SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-8.1.mga6"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:6","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1.mga6"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:6","package":"mingw-SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1.mga6"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:7","package":"sdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1.mga7"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:7","package":"mingw-SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1.mga7"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:7","package":"SDL_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-12.1.mga7"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"SDL-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"SDL-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"SDL-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"SDL-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"SDL-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"SDL-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"SDL-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"SDL-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"SDL-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"SDL-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"SDL-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"SDL-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-17.el7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-38.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"SDL-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-38.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"SDL-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-38.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"SDL-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15-38.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-15.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-3.9.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-3.9.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-106.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-106.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-106.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-106.11.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-8ubuntu1.1+esm1"}]}],"versions":["1.2.15-5ubuntu2","1.2.15-5ubuntu3","1.2.15-8ubuntu1","1.2.15-8ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-3+deb8u2build0.14.04.1~esm1"}]}],"versions":["2.0.0+dfsg-2","2.0.0+dfsg-3","2.0.0+dfsg-3build2","2.0.0+dfsg-3+deb8u1build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-5+deb9u1ubuntu0.14.04.1~esm1"}]}],"versions":["1.2.12-4ubuntu1","1.2.12-5","1.2.12-5build2","1.2.12-5+deb9u1build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg1-3ubuntu0.1"}]}],"versions":["1.2.15-11ubuntu1","1.2.15-12ubuntu1","1.2.15+dfsg1-3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4+dfsg1-2ubuntu2.16.04.2"}]}],"versions":["2.0.2+dfsg1-6ubuntu2","2.0.4+dfsg1-2","2.0.4+dfsg1-2ubuntu1","2.0.4+dfsg1-2ubuntu2","2.0.4+dfsg1-2ubuntu2.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-5+deb9u1ubuntu0.16.04.1"}]}],"versions":["1.2.12-5build2","1.2.12-5+deb9u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0+dfsg-3build2","2.0.1+dfsg-1","2.0.1+dfsg-2","2.0.1+dfsg-2+deb9u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg2-0.1ubuntu0.1"}]}],"versions":["1.2.15+dfsg2-0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8+dfsg1-1ubuntu1.18.04.4"}]}],"versions":["2.0.6+dfsg1-3ubuntu1","2.0.6+dfsg1-4ubuntu1","2.0.7+dfsg1-3ubuntu1","2.0.8+dfsg1-1ubuntu1","2.0.8+dfsg1-1ubuntu1.18.04.1","2.0.8+dfsg1-1ubuntu1.18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-8ubuntu0.1"}]}],"versions":["1.2.12-6","1.2.12-7","1.2.12-8"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+dfsg-3","2.0.1+dfsg-4","2.0.2+dfsg1-1","2.0.3+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4+dfsg1-2ubuntu2.16.04.2"}]}],"versions":["2.0.2+dfsg1-6ubuntu2","2.0.4+dfsg1-2","2.0.4+dfsg1-2ubuntu1","2.0.4+dfsg1-2ubuntu2","2.0.4+dfsg1-2ubuntu2.16.04.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libsdl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8+dfsg1-1ubuntu1.18.04.4"}]}],"versions":["2.0.6+dfsg1-3ubuntu1","2.0.6+dfsg1-4ubuntu1","2.0.7+dfsg1-3ubuntu1","2.0.8+dfsg1-1ubuntu1","2.0.8+dfsg1-1ubuntu1.18.04.1","2.0.8+dfsg1-1ubuntu1.18.04.3"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg1-3ubuntu0.1"}]}],"versions":["1.2.15-11ubuntu1","1.2.15-12ubuntu1","1.2.15+dfsg1-3"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15+dfsg2-0.1ubuntu0.1"}]}],"versions":["1.2.15+dfsg2-0.1"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-8ubuntu1.1+esm1"}]}],"versions":["1.2.15-5ubuntu2","1.2.15-5ubuntu3","1.2.15-8ubuntu1","1.2.15-8ubuntu1.1"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-5+deb9u1ubuntu0.16.04.1"}]}],"versions":["1.2.12-5build2","1.2.12-5+deb9u1build0.16.04.1"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-8ubuntu0.1"}]}],"versions":["1.2.12-6","1.2.12-7","1.2.12-8"],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-lp150.2.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-lp150.2.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"SDL_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12+hg695-lp151.3.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"SDL_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12+hg695-lp151.3.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"SDL_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12+hg695-bp151.4.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"SDL_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12+hg695-bp151.4.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.16-2.3"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"SDL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-1.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"SDL2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.8-1.1"}]}],"bundled":17}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libsdl","product":"simple_directmedia_layer"},{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00016.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://bugzilla.libsdl.org/show_bug.cgi?id=4498","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00015.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://discourse.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720","tags":["x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/07/msg00021.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201909-07","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4143-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4156-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4156-2/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00021.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00020.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4238-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00024.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00032.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202305-17","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7635","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/"},{"url":"https://github.com/advisories/GHSA-c83x-cr7v-6qrf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-7635","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-7635","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-7635","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0127.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24496","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OHEXXGCOKNICFBDMNVYYDTSDLQ42K5G5/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2019-0239.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24497","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13616","tags":["advisory"]},{"url":"https://hg.libsdl.org/SDL/file/bc90ce38f1e2/WhatsNew.txt","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2019-0363.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25766","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-09/msg00031.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3868","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676509","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676743","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676749","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676751","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676755","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676781","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677158","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3868.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7572","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7572","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7572","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7573","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7573","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7573","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7574","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7574","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7574","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7575","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7575","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7575","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7576","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7576","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7576","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7577","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7578","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7578","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7578","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7635","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7635","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7636","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7636","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7636","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7637","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7637","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7638","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7638","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7638","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4627","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4627.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190899-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1124799","tags":["report"]},{"url":"https://bugzilla.suse.com/1124800","tags":["report"]},{"url":"https://bugzilla.suse.com/1124802","tags":["report"]},{"url":"https://bugzilla.suse.com/1124803","tags":["report"]},{"url":"https://bugzilla.suse.com/1124805","tags":["report"]},{"url":"https://bugzilla.suse.com/1124806","tags":["report"]},{"url":"https://bugzilla.suse.com/1124824","tags":["report"]},{"url":"https://bugzilla.suse.com/1124825","tags":["report"]},{"url":"https://bugzilla.suse.com/1124826","tags":["report"]},{"url":"https://bugzilla.suse.com/1124827","tags":["report"]},{"url":"https://bugzilla.suse.com/1125099","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7638","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190917-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190950-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201913998-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-7635","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4143-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4156-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4156-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4238-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-2888","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7636","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7637","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7638","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7573","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7574","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7575","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-3977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-5051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-5052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12216","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12222","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PVVNKCWJ5RBDOAJTNQX6VN77H27KTKSW/#PVVNKCWJ5RBDOAJTNQX6VN77H27KTKSW","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MSOTDS52YKZL25TU3JHV22PWUVFQ6U5U/#MSOTDS52YKZL25TU3JHV22PWUVFQ6U5U","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3QX7GXNBMMTXZSXQVKMIC4P6EVVZNDRA/#3QX7GXNBMMTXZSXQVKMIC4P6EVVZNDRA","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1140421","tags":["report"]},{"url":"https://bugzilla.suse.com/1141844","tags":["report"]},{"url":"https://bugzilla.suse.com/1143763","tags":["report"]},{"url":"https://bugzilla.suse.com/1143764","tags":["report"]},{"url":"https://bugzilla.suse.com/1143766","tags":["report"]},{"url":"https://bugzilla.suse.com/1143768","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5060","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LT2L2SUT2SJMJ23HFEUSMEN3PCAFI5LM/#LT2L2SUT2SJMJ23HFEUSMEN3PCAFI5LM","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-4743","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-7635","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.","status":"published","published":"2019-02-08T00:00:00Z","modified":"2024-08-04T20:54:28.411Z","updated_at":"2026-11-02T14:32:22.854093Z"}],"euvd":[{"id":"EUVD-2019-17168","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.","status":"published","published":"2019-02-08T00:00:00Z","modified":"2024-08-04T20:54:28Z","updated_at":"2026-11-03T03:06:45.52347Z"}],"ghsa":[{"id":"GHSA-c83x-cr7v-6qrf","title":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over...","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.","status":"published","published":"2022-05-13T01:04:45Z","modified":"2023-05-12T05:00:26Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:54:35.04449Z"}],"nvd":[{"id":"CVE-2019-7635","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.","status":"published","published":"2019-02-08T11:29:00.233Z","modified":"2026-06-17T02:40:47.187Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:04.689371Z"}],"osv":[{"id":"ALPINE-CVE-2019-7635","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.","status":"published","published":"2019-02-08T11:29:00.233Z","modified":"2026-11-03T06:31:38.283779038Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:18:23.800469Z"},{"id":"BELL-CVE-2019-7635","title":"CVE-2019-7635 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:26.874282Z","modified":"2026-01-26T09:46:36.429108Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-7635","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.","status":"published","published":"2019-02-08T11:29:00.233Z","modified":"2026-10-24T10:30:29.75818224Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"DEBIAN-CVE-2019-7635","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.","status":"published","published":"2019-02-08T11:29:00.233Z","modified":"2026-09-21T07:03:24.045537355Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"RHSA-2020:3868","title":"Red Hat Security Advisory: SDL security update","status":"published","published":"2024-09-16T03:34:09Z","modified":"2026-06-26T10:50:10Z","cvss":[{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:4627","title":"Red Hat Security Advisory: SDL security update","status":"published","published":"2024-09-16T03:34:17Z","modified":"2026-01-14T11:02:55.694089Z","cvss":[{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2019-7635","description":"SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.","status":"published","published":"2019-02-08T00:00:00Z","modified":"2026-04-22T12:21:51.183184Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"DLA-1713-1","title":"libsdl1.2 - security update","status":"published","published":"2019-03-13T00:00:00Z","modified":"2026-03-09T01:19:51.755742Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-1714-1","title":"libsdl2 - security update","status":"published","published":"2019-03-13T00:00:00Z","modified":"2026-03-09T01:20:20.726517Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-1861-1","title":"libsdl2-image - security update","status":"published","published":"2019-07-22T00:00:00Z","modified":"2026-03-09T01:18:26.915964Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-1865-1","title":"sdl-image1.2 - security update","status":"published","published":"2019-07-27T00:00:00Z","modified":"2026-03-09T01:21:46.079457Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2536-1","title":"libsdl2 - security update","status":"published","published":"2021-01-30T00:00:00Z","modified":"2026-03-09T01:18:31.048555Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-2804-1","title":"libsdl1.2 - security update","status":"published","published":"2021-10-31T00:00:00Z","modified":"2026-03-09T01:22:59.700826Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3314-1","title":"libsdl2 - security update","status":"published","published":"2023-02-09T00:00:00Z","modified":"2026-03-09T01:21:53.582533Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2019-0127","title":"Updated SDL12 packages fix security vulnerability","description":"This release fixes various buffer overflows when parsing or processing\ndamaged Waveform audio and BMP image files.\n- Fix CVE-2019-7577 (a buffer overread in MS_ADPCM_decode) (rhbz#1676510)\n- Fix CVE-2019-7575 (a buffer overwrite in MS_ADPCM_decode) (rhbz#1676744)\n- Fix CVE-2019-7574 (a buffer overread in IMA_ADPCM_decode) (rhbz#1676750)\n- Fix CVE-2019-7572 (a buffer overread in IMA_ADPCM_nibble) (rhbz#1676754)\n- Fix CVE-2019-7572 (a buffer overwrite in IMA_ADPCM_nibble) (rhbz#1676754)\n- Fix CVE-2019-7573, CVE-2019-7576 (buffer overreads in InitMS_ADPCM)\n  (rhbz#1676752, rhbz#1676756)\n- Fix CVE-2019-7578 (a buffer overread in InitIMA_ADPCM) (rhbz#1676782)\n- Fix CVE-2019-7638, CVE-2019-7636 (buffer overflows when processing BMP\n  images with too high number of colors) (rhbz#1677144, rhbz#1677157)\n- Fix CVE-2019-7637 (an integer overflow in SDL_CalculatePitch)\n  (rhbz#1677152)\n- Fix CVE-2019-7635 (a buffer overread when blitting a BMP image with pixel\n  colors out the palette) (rhbz#1677159)\n- Reject 2, 3, 5, 6, 7-bpp BMP images (rhbz#1677159)\n","status":"published","published":"2019-04-05T18:12:59Z","modified":"2026-04-16T04:41:39.566471751Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2019-0239","title":"Updated sdl2 packages fix security vulnerabilities","description":"Updated sdl2 packages fix security vulnerabilities\n\nThis release fixes various buffer overflows when parsing or processing\ndamaged Waveform audio and BMP image files.\n\n- Fix CVE-2019-7572 (a buffer overread in IMA_ADPCM_nibble) (rhbz#1676754)\n- Fix CVE-2019-7572 (a buffer overwrite in IMA_ADPCM_nibble) (rhbz#1676754)\n- Fix CVE-2019-7573, CVE-2019-7576 (buffer overreads in InitMS_ADPCM)\n  (rhbz#1676752, rhbz#1676756)\n- Fix CVE-2019-7574 (a buffer overread in IMA_ADPCM_decode) (rhbz#1676750)\n- Fix CVE-2019-7575 (a buffer overwrite in MS_ADPCM_decode) (rhbz#1676744)\n- Fix CVE-2019-7577 (a buffer overread in MS_ADPCM_decode) (rhbz#1676510)\n- Fix CVE-2019-7578 (a buffer overread in InitIMA_ADPCM) (rhbz#1676782)\n- Fix CVE-2019-7635 (a buffer overread when blitting a BMP image with pixel\n  colors out the palette) (rhbz#1677159)\n- Fix CVE-2019-7636, CVE-2019-7638 (buffer overflows when processing BMP\n  images with too high number of colors) (rhbz#1677144, rhbz#1677157)\n- Fix CVE-2019-7637 (an integer overflow in SDL_CalculatePitch)\n  (rhbz#1677152)\n- Reject 2, 3, 5, 6, 7-bpp BMP images (rhbz#1677159)\n- Fix CVE-2010-13616 (heap-based buffer over-read in BlitNtoN in\n  video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c)\n\nThe 2.0.10 release also provides various features and bug fixes.\n","status":"published","published":"2019-09-06T21:09:08Z","modified":"2026-04-16T06:25:16.293559732Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2019-0363","title":"Updated SDL_image packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\n\nAn exploitable code execution vulnerability exists in the XCF image\nrendering functionality of SDL2_image-2.0.3. A specially crafted XCF\nimage can cause a heap overflow, resulting in code execution. An attacker\ncan display a specially crafted image to trigger this vulnerability.\n(CVE-2018-3977)\n\nAn exploitable integer overflow vulnerability exists when loading a PCX\nfile in SDL2_image 2.0.4. A specially crafted file can cause an integer\noverflow, resulting in too little memory being allocated, which can lead\nto a buffer overflow and potential code execution. (CVE-2019-5052)\n\nAn exploitable code execution vulnerability exists in the XCF image\nrendering functionality of SDL2_image 2.0.4. A specially crafted XCF image\ncan cause a heap overflow, resulting in code execution. (CVE-2019-5058)\n\nAn exploitable code execution vulnerability exists in the XPM image\nrendering functionality of SDL2_image 2.0.4. A specially crafted XPM image\ncan cause an integer overflow, allocating too small of a buffer. This\nbuffer can then be written out of bounds resulting in a heap overflow,\nultimately ending in code execution. (CVE-2019-5059)\n\nAn exploitable code execution vulnerability exists in the XPM image\nrendering function of SDL2_image 2.0.4. A specially crafted XPM image can\ncause an integer overflow in the colorhash function, allocating too small\nof a buffer. This buffer can then be written out of bounds, resulting in a\nheap overflow, ultimately ending in code execution. (CVE-2019-5060)\n\nSDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a\nheap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c\n(CVE-2019-7635).\n\nAn issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL)\n2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4.\nThere is a NULL pointer dereference in the SDL stdio_read function in\nfile/SDL_rwops.c. (CVE-2019-12217)\n\nAn issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL)\n2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4.\nThere is a NULL pointer dereference in the SDL2_image function\nIMG_LoadPCX_RW at IMG_pcx.c. (CVE-2019-12218)\n\nAn issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL)\n2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4.\nThere is an invalid free error in the SDL function SDL_SetError_REAL\nat SDL_error.c. (CVE-2019-12219)\n\nAn issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL)\n2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4.\nThere is an out-of-bounds read in the SDL function SDL_FreePalette_REAL\nat video/SDL_pixels.c. (CVE-2019-12220)\n\nAn issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL)\n2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4.\nThere is a SEGV in the SDL function SDL_free_REAL at stdlib/SDL_malloc.c.\n(CVE-2019-12221)\n\nAn issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL)\n2.0.9. There is an out-of-bounds read in the function SDL_InvalidateMap\nat video/SDL_pixels.c. (CVE-2019-12222)\n\nSDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has\na heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when\ncalled from SDL_SoftBlit in video/SDL_blit.c. (CVE-2019-13616)\n","status":"published","published":"2019-12-06T14:15:42Z","modified":"2026-04-16T04:43:16.504296531Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:1223-1","title":"Security update for SDL","description":"This update for SDL fixes the following issues:\n\nSecurity issues fixed:\t  \n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-17T13:29:07Z","modified":"2025-05-02T04:30:19.611361Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1261-1","title":"Security update for SDL2","description":"This update for SDL2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-23T15:07:46Z","modified":"2026-02-04T02:29:31.23932Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2071-1","title":"Security update for SDL_image","description":"This update for SDL_image fixes the following issues:\n\nUpdate SDL_Image to new snapshot 1.2.12+hg695.\n\nSecurity issues fixed:\n\n* TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421)\n* TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763)\n* TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764)\n* TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image handling (boo#1143766)\n* TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768)\n* CVE-2019-7635: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (boo#1124827)\n* CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844).\n","status":"published","published":"2019-09-05T08:23:59Z","modified":"2025-05-07T18:10:35.915722Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2109-1","title":"Security update for SDL_image","description":"This update for SDL_image fixes the following issues:\n\nUpdate SDL_Image to new snapshot 1.2.12+hg695.\n\nSecurity issues fixed:\n\n* TALOS-2019-0821 CVE-2019-5052: exploitable integer overflow vulnerability when loading a PCX file (boo#1140421)\n* TALOS-2019-0841 CVE-2019-5057: code execution vulnerability in the PCX image-rendering functionality of SDL2_image (boo#1143763)\n* TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF image rendering can lead to code execution (boo#1143764)\n* TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM image handling (boo#1143766)\n* TALOS-2019-0844 CVE-2019-5060: integer overflow in the XPM image (boo#1143768)\n* CVE-2019-7635: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (boo#1124827)\n* CVE-2019-13616: fix heap buffer overflow when reading a crafted bmp file (boo#1141844).\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-09-10T14:20:33Z","modified":"2026-02-04T03:06:56.874569Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10606-1","title":"libSDL-1_2-0-1.2.15-22.13 on GA media","description":"These are all security issues fixed in the libSDL-1_2-0-1.2.15-22.13 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:22:08.154225Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10607-1","title":"libSDL2-2_0-0-2.0.16-2.3 on GA media","description":"These are all security issues fixed in the libSDL2-2_0-0-2.0.16-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:24:42.777648Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10609-1","title":"libSDL_image-1_2-0-1.2.12+hg695-1.12 on GA media","description":"These are all security issues fixed in the libSDL_image-1_2-0-1.2.12+hg695-1.12 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:52:42.754915Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2025:15205-1","title":"SDL-1.2.15-1.1 on GA media","description":"These are all security issues fixed in the SDL-1.2.15-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:29.841137Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15206-1","title":"SDL2-2.32.8-1.1 on GA media","description":"These are all security issues fixed in the SDL2-2.32.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:29.880873Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2019:0899-1","title":"Security update for SDL","description":"This update for SDL fixes the following issues:\n\t  \nSecurity issues fixed:\t  \n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800). \n","status":"published","published":"2019-04-08T09:10:07Z","modified":"2026-02-04T03:23:45.255875Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0917-1","title":"Security update for SDL","description":"This update for SDL fixes the following issues:\n\nSecurity issues fixed:\t  \n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).\n","status":"published","published":"2019-04-09T11:08:17Z","modified":"2026-02-04T04:34:14.234453Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0950-1","title":"Security update for SDL2","description":"This update for SDL2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).\n","status":"published","published":"2019-04-15T09:56:40Z","modified":"2026-02-04T04:38:41.109854Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:13998-1","title":"Security update for SDL","description":"This update for SDL fixes the following issues:\n\nSecurity issues fixed:\t  \n\n- CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).\n- CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).\n- CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).\n- CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).\n- CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).\n- CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).\n- CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).\n- CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).\n- CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).\n- CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).\t  \n- CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).\n","status":"published","published":"2019-03-29T15:33:20Z","modified":"2026-02-04T03:05:32.340362Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-4143-1","title":"SDL 2.0 vulnerabilities","description":"It was discovered that SDL 2.0 mishandled crafted image files resulting in an\ninteger overflow. If a user were tricked into opening a malicious file, SDL\n2.0 could be caused to crash or potentially run arbitrary code.\n(CVE-2017-2888)\n\nIt was discovered that SDL 2.0 mishandled crafted image files. If a user were \ntricked into opening a malicious file, SDL 2.0 could be caused to crash or \npotentially run arbitrary code.\n(CVE-2019-7635, CVE-2019-7636, CVE-2019-7637, CVE-2019-7638)\n","status":"published","published":"2019-09-30T15:05:54Z","modified":"2026-04-27T15:33:01.962789013Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4156-1","title":"libsdl1.2 vulnerabilities","description":"It was discovered that SDL incorrectly handled certain images. If a user\nwere tricked into opening a crafted image file, a remote attacker could\nuse this issue to cause SDL to crash, resulting in a denial of service, or\npossibly execute arbitrary code.\n","status":"published","published":"2019-10-15T18:27:06Z","modified":"2026-04-27T15:33:07.371481362Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4156-2","title":"libsdl1.2 vulnerabilities","description":"USN-4156-1 fixed several vulnerabilities in SDL. This update provides\nthe corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that SDL incorrectly handled certain images. If a user\n were tricked into opening a crafted image file, a remote attacker could\n use this issue to cause SDL to crash, resulting in a denial of service, or\n possibly execute arbitary code.\n","status":"published","published":"2019-10-16T14:21:02Z","modified":"2026-04-27T15:33:07.150217963Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4238-1","title":"sdl-image1.2 vulnerabilities","description":"It was discovered that SDL_image incorrectly handled certain image files. An\nattacker could possibly use this issue to cause a denial of service or other\nunspecified impact.\n","status":"published","published":"2020-01-14T15:01:52Z","modified":"2026-04-27T15:48:45.87255876Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}