Sicherheit: Mehrere Probleme in SDL2_Image

Lesezeichen hinzufügen

--JP+T4n/bALQSJXh8
Content-Type: text/plain; charset=utf-8
Content-Disposition: inlin
Content-Transfer-Encoding: quoted-printable

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201903-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: SDL2_Image: Multiple vulnerabilities
Date: March 28, 2019
Bugs: #655226, #674132
ID: 201903-17

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been found in the image loading library
for Simple DirectMedia Layer, the worst of which could result in the
remote execution of arbitrary code.

Background
==========

SDL_image is an image file library that loads images as SDL surfaces,
and supports various formats like BMP, GIF, JPEG, LBM, PCX, PNG, PNM,
TGA, TIFF, XCF, XPM, and XV.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 media-libs/sdl2-image < 2.0.4 >= 2.0.4

Description
===========

Multiple vulnerabilities have been discovered in SDL2_Image. Please
review the CVE identifiers referenced below for details.

Impact
======

A remote attacker, by enticing a user to process a specially crafted
image file, could execute arbitrary code, cause a Denial of Service
condition, or obtain sensitive information.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All SDL2_Image users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/sdl2-image-2.0.4"

References
==========

[ 1 ] CVE-2017-12122
https://nvd.nist.gov/vuln/detail/CVE-2017-12122
[ 2 ] CVE-2017-14440
https://nvd.nist.gov/vuln/detail/CVE-2017-14440
[ 3 ] CVE-2017-14441
https://nvd.nist.gov/vuln/detail/CVE-2017-14441
[ 4 ] CVE-2017-14442
https://nvd.nist.gov/vuln/detail/CVE-2017-14442
[ 5 ] CVE-2017-14448
https://nvd.nist.gov/vuln/detail/CVE-2017-14448
[ 6 ] CVE-2017-14449
https://nvd.nist.gov/vuln/detail/CVE-2017-14449
[ 7 ] CVE-2017-14450
https://nvd.nist.gov/vuln/detail/CVE-2017-14450
[ 8 ] CVE-2018-3837
https://nvd.nist.gov/vuln/detail/CVE-2018-3837
[ 9 ] CVE-2018-3838
https://nvd.nist.gov/vuln/detail/CVE-2018-3838
[ 10 ] CVE-2018-3839
https://nvd.nist.gov/vuln/detail/CVE-2018-3839
[ 11 ] CVE-2018-3977
https://nvd.nist.gov/vuln/detail/CVE-2018-3977

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/201903-17

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2019 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

--JP+T4n/bALQSJXh8
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAABCAAdFiEEiDRK3jyVBE/RkymqpRQw84X1dt0FAlycLHkACgkQpRQw84X1
dt3PUwf/Xv0q8muE7VNDJbkaN+jJ5wyYqN8IiLxt5+pyNPPfZV1JXmlLLVWy4ipS
vq53Klj8VkHd507bEt/an2dBJeWBUHE2xSf5L0UwzFkArssTc2mCki+Z33PZCCXn
Bis0UN2idCMwBIyNLoVW36mVRB1IS3F+8q3YE2BYzB4kMsKek0wtAASI63ZupGNO
ZxVgspdAnaGh7M17eYxs1Z5vnIAJqj1Mc82+Kpyu6HUCEmD3snu/YWT6H82TPyC6
WQj18wyBm4SVyKwrD3JeEUim+JnbC86Sx4hL69Eu44GGpLuuoWnuiTRPnBPd7nP0
UP28LlB5xC+oqJClmhIqx5ZyidKxsQ==
=jqif
-----END PGP SIGNATURE-----

--JP+T4n/bALQSJXh8--