{"schemaVersion":3,"id":"MGASA-2018-0454","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Updated sdl2/mingw-SDL2 packages fix security vulnerabilities\n\nThis update fixes various security vulnerabilities affecting the\nSDL2_image library, listed below. The fixes are provided in SDL2_image\n2.0.4, which depends on SDL2 2.0.8 or later. As such, the SDL2 and\nSDL2_mixer libraries are also updated to their current stable releases,\nproviding various bug fixes and features.\n\nThe security vulnerabilities fixed in this update are the following:\n\nAn exploitable code execution vulnerability exists in the ILBM image\nrendering functionality of SDL2_image-2.0.2. A specially crafted ILBM\nimage can cause a heap overflow resulting in code execution. An attacker\ncan display a specially crafted image to trigger this vulnerability.\n(TALOS-2017-0488, CVE-2017-12122)\n\nAn exploitable code execution vulnerability exists in the ILBM image\nrendering functionality of SDL2_image-2.0.2. A specially crafted ILBM\nimage can cause a stack overflow resulting in code execution. An\nattacker can display a specially crafted image to trigger this\nvulnerability. (TALOS-2017-0489, CVE-2017-14440)\n\nAn exploitable code execution vulnerability exists in the ICO image\nrendering functionality of SDL2_image-2.0.2. A specially crafted ICO\nimage can cause an integer overflow, cascading to a heap overflow\nresulting in code execution. An attacker can display a specially crafted\nimage to trigger this vulnerability. (TALOS-2017-0490, CVE-2017-14441)\n\nAn exploitable code execution vulnerability exists in the BMP image\nrendering functionality of SDL2_image-2.0.2. A specially crafted BMP\nimage can cause a stack overflow resulting in code execution. An\nattacker can display a specially crafted image to trigger this\nvulnerability. (TALOS-2017-0491, CVE-2017-14442)\n\nAn exploitable code execution vulnerability exists in the XCF image\nrendering functionality of SDL2_image-2.0.2. A specially crafted XCF\nimage can cause a heap overflow resulting in code execution. An\nattacker can display a specially crafted image to trigger this\nvulnerability. (TALOS-2017-0497, CVE-2017-14448)\n\nA double-Free vulnerability exists in the XCF image rendering\nfunctionality of SDL2_image-2.0.2. A specially crafted XCF image can\ncause a Double-Free situation to occur. An attacker can display a\nspecially crafted image to trigger this vulnerability.\n(TALOS-2017-0498, CVE-2017-14449)\n\nA buffer overflow vulnerability exists in the GIF image parsing\nfunctionality of SDL2_image-2.0.2. A specially crafted GIF image can\nlead to a buffer overflow on a global section. An attacker can display\nan image to trigger this vulnerability. (TALOS-2017-0499,\nCVE-2017-14450)\n\nAn exploitable information disclosure vulnerability exists in the PCX\nimage rendering functionality of SDL2_image-2.0.2. A specially crafted\nPCX image can cause an out-of-bounds read on the heap, resulting in\ninformation disclosure. An attacker can display a specially crafted\nimage to trigger this vulnerability. (TALOS-2018-0519, CVE-2018-3837)\n\nAn exploitable information vulnerability exists in the XCF image\nrendering functionality of SDL2_image-2.0.2. A specially crafted XCF\nimage can cause an out-of-bounds read on the heap, resulting in\ninformation disclosure. An attacker can display a specially crafted\nimage to trigger this vulnerability. (TALOS-2018-0520, CVE-2018-3838)\n\nAn exploitable code execution vulnerability exists in the XCF image\nrendering functionality of SDL2_image-2.0.2. A specially crafted XCF\nimage can cause an out-of-bounds write on the heap, resulting in code\nexecution. An attacker can display a specially crafted image to trigger\nthis vulnerability. (TALOS-2018-0521, CVE-2018-3839)\n\nAn exploitable code execution vulnerability exists in the XCF image\nrendering functionality of SDL2_image-2.0.3. A specially crafted XCF\nimage can cause a heap overflow, resulting in code execution. An\nattacker can display a specially crafted image to trigger this\nvulnerability. (TALOS-2018-0645, CVE-2018-3977)","dates":{"published":"2018-11-17T22:23:26.000Z","modified":"2026-04-16T06:23:47.754Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"mageia","product":"mingw-SDL2","name":"mingw-SDL2","label":"mingw-SDL2","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/mingw-SDL2","purlType":"rpm","versions":[{"text":"< 2.0.9-1.mga6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.9-1.mga6","eol":null,"hubHref":null},{"vendor":"mageia","product":"mingw-SDL2_image","name":"mingw-SDL2_image","label":"mingw-SDL2_image","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/mingw-SDL2_image","purlType":"rpm","versions":[{"text":"< 2.0.4-1.mga6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.4-1.mga6","eol":null,"hubHref":null},{"vendor":"mageia","product":"mingw-SDL2_mixer","name":"mingw-SDL2_mixer","label":"mingw-SDL2_mixer","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/mingw-SDL2_mixer","purlType":"rpm","versions":[{"text":"< 2.0.4-1.mga6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.4-1.mga6","eol":null,"hubHref":null},{"vendor":"mageia","product":"sdl2","name":"sdl2","label":"sdl2","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/sdl2","purlType":"rpm","versions":[{"text":"< 2.0.9-1.mga6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.9-1.mga6","eol":null,"hubHref":null},{"vendor":"mageia","product":"sdl2_image","name":"sdl2_image","label":"sdl2_image","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/sdl2_image","purlType":"rpm","versions":[{"text":"< 2.0.4-1.mga6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.4-1.mga6","eol":null,"hubHref":null},{"vendor":"mageia","product":"sdl2_mixer","name":"sdl2_mixer","label":"sdl2_mixer","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/sdl2_mixer","purlType":"rpm","versions":[{"text":"< 2.0.4-1.mga6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.4-1.mga6","eol":null,"hubHref":null}],"affectedCount":6,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://advisories.mageia.org/MGASA-2018-0454.html","label":"advisories.mageia.org/MGASA-2018-0454.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22769","label":"bugs.mageia.org/show_bug.cgi?id=22769","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0488","label":"talosintelligence.com/vulnerability_reports/TALOS-2017-0488","hostname":"talosintelligence.com","tags":["WEB"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0489","label":"talosintelligence.com/vulnerability_reports/TALOS-2017-0489","hostname":"talosintelligence.com","tags":["WEB"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0490","label":"talosintelligence.com/vulnerability_reports/TALOS-2017-0490","hostname":"talosintelligence.com","tags":["WEB"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0491","label":"talosintelligence.com/vulnerability_reports/TALOS-2017-0491","hostname":"talosintelligence.com","tags":["WEB"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0497","label":"talosintelligence.com/vulnerability_reports/TALOS-2017-0497","hostname":"talosintelligence.com","tags":["WEB"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0498","label":"talosintelligence.com/vulnerability_reports/TALOS-2017-0498","hostname":"talosintelligence.com","tags":["WEB"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2017-0499","label":"talosintelligence.com/vulnerability_reports/TALOS-2017-0499","hostname":"talosintelligence.com","tags":["WEB"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0519","label":"talosintelligence.com/vulnerability_reports/TALOS-2018-0519","hostname":"talosintelligence.com","tags":["WEB"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0520","label":"talosintelligence.com/vulnerability_reports/TALOS-2018-0520","hostname":"talosintelligence.com","tags":["WEB"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0521","label":"talosintelligence.com/vulnerability_reports/TALOS-2018-0521","hostname":"talosintelligence.com","tags":["WEB"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0645","label":"talosintelligence.com/vulnerability_reports/TALOS-2018-0645","hostname":"talosintelligence.com","tags":["WEB"]},{"url":"https://hg.libsdl.org/SDL/file/8feb5da6f2fb/WhatsNew.txt","label":"hg.libsdl.org/SDL/file/8feb5da6f2fb/WhatsNew.txt","hostname":"hg.libsdl.org","tags":["WEB"]},{"url":"https://www.libsdl.org/projects/SDL_image/","label":"www.libsdl.org/projects/SDL_image/","hostname":"www.libsdl.org","tags":["WEB"]},{"url":"https://www.libsdl.org/projects/SDL_mixer/","label":"www.libsdl.org/projects/SDL_mixer/","hostname":"www.libsdl.org","tags":["WEB"]}],"lineage":{"upstream":["CVE-2017-12122","CVE-2017-14440","CVE-2017-14441","CVE-2017-14442","CVE-2017-14448","CVE-2017-14449","CVE-2017-14450","CVE-2018-3837","CVE-2018-3838","CVE-2018-3839","CVE-2018-3977"],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-11-17T22:23:26.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-16T06:23:47.754Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T04:50:33.474Z","stale":false,"partial":false}}