Description (CNA)
An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / SDL | affected SDL_Image 2.0.4 |
CWE
CWE-122
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0842
ADP enrichment
No English description supplied.
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0842