Debian update for libsdl2-image
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 11 |
| CVE-ID | CVE-2017-2887 CVE-2017-12122 CVE-2017-14440 CVE-2017-14441 CVE-2017-14442 CVE-2017-14448 CVE-2017-14449 CVE-2017-14450 CVE-2018-3837 CVE-2018-3838 CVE-2018-3839 |
| CWE-ID | CWE-121 CWE-122 CWE-190 CWE-415 CWE-120 CWE-125 CWE-787 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software Subscribe |
Debian Linux Operating systems & Components / Operating system |
| Vendor | Debian |
Security Bulletin
This security bulletin contains information about 11 vulnerabilities.
1) Stack-based buffer overflow
EUVDB-ID: #VU8789
Risk: High
CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2017-2887
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists in the XCF property handling function of Simple DirectMedia Layer SDL_image due to stack-based buffer overflow. A remote attacker can send a specially crafted xcf file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package to version: 2.0.0+dfsg-3+deb8u1, 2.0.1+dfsg-2+deb9u1
Vulnerable software versionsDebian Linux: All versions
CPE2.3 External linkshttp://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0394
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
2) Heap-based buffer overflow
EUVDB-ID: #VU11244
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-12122
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists in the ILBM image rendering functionality due to heap-based buffer overflow. A remote attacker can send a specially crafted image, trick the victim into opening it and execute arbitrary code.
Update the affected package to version: 2.0.0+dfsg-3+deb8u1, 2.0.1+dfsg-2+deb9u1
Vulnerable software versionsDebian Linux: All versions
CPE2.3 External linkshttp://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12122
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Stack-based buffer overflow
EUVDB-ID: #VU11245
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-14440
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists in the ILBM image rendering functionality due to stack-based buffer overflow. A remote attacker can send a specially crafted image, trick the victim into opening it and execute arbitrary code.
Update the affected package to version: 2.0.0+dfsg-3+deb8u1, 2.0.1+dfsg-2+deb9u1
Vulnerable software versionsDebian Linux: All versions
CPE2.3 External linkshttp://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-14440
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Integer overflow
EUVDB-ID: #VU11246
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-14441
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists in the ICO image rendering functionality due to integer overflow. A remote attacker can send a specially crafted image, trick the victim into opening it and execute arbitrary code.
Update the affected package to version: 2.0.0+dfsg-3+deb8u1, 2.0.1+dfsg-2+deb9u1
Vulnerable software versionsDebian Linux: All versions
CPE2.3 External linkshttp://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-14441
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Stack-based buffer overflow
EUVDB-ID: #VU11247
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-14442
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists in the BMP image rendering functionality due to stack-based buffer overflow. A remote attacker can send a specially crafted image, trick the victim into opening it and execute arbitrary code.
Update the affected package to version: 2.0.0+dfsg-3+deb8u1, 2.0.1+dfsg-2+deb9u1
Vulnerable software versionsDebian Linux: All versions
CPE2.3 External linkshttp://bugzilla.redhat.com/show_bug.cgi?id=1552196
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Heap-based buffer overflow
EUVDB-ID: #VU11248
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-14448
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists in the XCF image rendering functionality due to heap-based buffer overflow. A remote attacker can send a specially crafted image, trick the victim into opening it and execute arbitrary code.
Update the affected package to version: 2.0.0+dfsg-3+deb8u1, 2.0.1+dfsg-2+deb9u1
Vulnerable software versionsDebian Linux: All versions
CPE2.3 External linkshttp://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-14448
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Double free
EUVDB-ID: #VU11249
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-14449
CWE-ID:
CWE-415 - Double Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists in the XCF image rendering functionality due to double free. A remote attacker can send a specially crafted image, trick the victim into opening it and execute arbitrary code.
Update the affected package to version: 2.0.0+dfsg-3+deb8u1, 2.0.1+dfsg-2+deb9u1
Vulnerable software versionsDebian Linux: All versions
CPE2.3 External linkshttp://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-14449
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Buffer overflow
EUVDB-ID: #VU11250
Risk: Low
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-14450
CWE-ID:
CWE-120 - Buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists in the GIF image parsing functionality due to buffer overflow. A remote attacker can send a specially crafted image, trick the victim into opening it and execute arbitrary code.
Update the affected package to version: 2.0.0+dfsg-3+deb8u1, 2.0.1+dfsg-2+deb9u1
Vulnerable software versionsDebian Linux: All versions
CPE2.3 External linkshttp://bugzilla.redhat.com/show_bug.cgi?id=1552190
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Out-of-bounds read
EUVDB-ID: #VU12121
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-3837
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists in the PCX image rendering functionality due to out-of-bounds read on the heap. A remote attacker can display a specially crafted PCX image, trick the victim into opening it and gain access to potentially sensitive information.
Update the affected package to version: 2.0.0+dfsg-3+deb8u1, 2.0.1+dfsg-2+deb9u1
Vulnerable software versionsDebian Linux: All versions
CPE2.3 External linkshttp://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-3837
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Out-of-bounds read
EUVDB-ID: #VU12122
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-3838
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists in the XCF image rendering functionality due to out-of-bounds read on the heap. A remote attacker can display a specially crafted XCF image, trick the victim into opening it and gain access to potentially sensitive information.
Update the affected package to version: 2.0.0+dfsg-3+deb8u1, 2.0.1+dfsg-2+deb9u1
Vulnerable software versionsDebian Linux: All versions
CPE2.3 External linkshttp://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-3838
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Out-of-bounds write
EUVDB-ID: #VU12123
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-3839
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists in the XCF image rendering functionality due to out-of-bounds write on the heap. A remote attacker can display a specially crafted XCF image, trick the victim into opening it and execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
Update the affected package to version: 2.0.0+dfsg-3+deb8u1, 2.0.1+dfsg-2+deb9u1
Vulnerable software versionsDebian Linux: All versions
CPE2.3 External linkshttp://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-3838
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
