8.1

CVE-2019-13616: canonical ubuntu_linux Out-of-bounds Read

CVSS: 8.1v3.1HighModified
AliasesALPINE-CVE-2019-13616MGASA-2019-0254SUSE-SU-2020:3030-1
Published 16-07-2019Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2019-13616 is a high (CVSS 8.1) Out-of-bounds Read vulnerability in canonical ubuntu_linux. EPSS estimates a 3.73% chance of exploitation in the next 30 days, higher than 89.6% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
43/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.1/10
010
High · v3.1 (NVD)
EPSS score
3.73%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 19 · Related 14
DLA-2536-1DLA-2804-1DLA-3314-1MGASA-2019-0363MGASA-2019-0364OPENSUSE-SU-2019:2070-1

Timeline

  1. 16-07-2019
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.

CVSS metrics

6 scores · 5 sources · 3 versions

EPSS trend

Probability

3.73%

Chance of exploitation in the next 30 days

Percentile

90%

Versus all other CVEs

30-day change

+0.03 pp

From 3.70% on 18-09-2026

18-09-202618-10-2026
EPSS score
3.73%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (bugzilla.libsdl.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Redhat12 products
Debian5 products
  • libsdl1.2< 1.2.15+dfsg2-5
  • libsdl2< 2.0.10+dfsg1-1
  • libsdl2-image< 2.0.5+dfsg1-2
  • sdl-image1.2< 1.2.12-12
  • debian_linuxEOL9.0 | 10.0
Suse5 products
  • SDL&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1< 1.2.15-3.12.73
  • SDL&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP2< 1.2.15-3.12.73
  • SDL&distro=SUSE Linux Enterprise Server 12 SP5< 1.2.15-15.14.2
  • SDL&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 1.2.15-15.14.2
  • SDL&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 1.2.15-15.14.2
Opensuse4 products
  • backports_sle15.0 | 15.0:sp1
  • leapEOL15.0 | 15.1
  • SDL&distro=openSUSE Leap 15.1< 1.2.15-lp151.4.3.1
  • SDL&distro=openSUSE Leap 15.2< 1.2.15-lp152.5.3.1
Ubuntu4 products
  • libsdl1.2< 1.2.15-8ubuntu1.1+esm1 | < 1.2.15+dfsg1-3ubuntu0.1 | < 1.2.15+dfsg2-0.1ubuntu0.1
  • libsdl2All versions (No fix recorded)
  • libsdl2-imageAll versions (No fix recorded)
  • sdl-image1.2< 1.2.12-5+deb9u1ubuntu0.14.04.1~esm1 | < 1.2.12-5+deb9u1ubuntu0.16.04.1 | < 1.2.12-8ubuntu0.1
Alpine3 products
  • sdl< 1.2.15-r12 | < 1.2.15-r9 | < 1.2.15-r10 | < 1.2.15-r11
  • sdl_image< 1.2.12-r5 | < 1.2.12-r4
  • sdl2_image< 2.0.5-r1
Mageia2 products
  • SDL12< 1.2.15-19.2.mga6
  • SDL12< 1.2.15-23.1.mga7
Canonical1 product
Fedoraproject1 product
Libsdl1 product

10 vendors · 38 products

References

45 links
Show all 45 references