SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buffer over-read in Fill_IMA_ADPCM_block, caused by an integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3314 advisory.

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c. (CVE-2019-13616)

  - SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buffer over-read in     Fill_IMA_ADPCM_block, caused by an integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c.
    (CVE-2019-13626)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in     IMA_ADPCM_nibble in audio/SDL_wave.c. (CVE-2019-7572)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef loop). (CVE-2019-7573)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     IMA_ADPCM_decode in audio/SDL_wave.c. (CVE-2019-7574)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in     MS_ADPCM_decode in audio/SDL_wave.c. (CVE-2019-7575)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop). (CVE-2019-7576)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in     SDL_LoadWAV_RW in audio/SDL_wave.c. (CVE-2019-7577)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitIMA_ADPCM in audio/SDL_wave.c. (CVE-2019-7578)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     Blit1to4 in video/SDL_blit_1.c. (CVE-2019-7635)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     SDL_GetRGB in video/SDL_pixels.c. (CVE-2019-7636)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     Map1toN in video/SDL_pixels.c. (CVE-2019-7638)

  - SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap     corruption) in SDL_BlitCopy in video/SDL_blit_copy.c via a crafted .BMP file. (CVE-2020-14409)

  - SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in     Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP file. (CVE-2020-14410)

  - There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18     versions. By crafting a malicious .BMP file, an attacker can cause the application using this library to     crash, denial of service or Code execution. (CVE-2021-33657)

  - A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in     SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The     vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected. (CVE-2022-4743)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for SDL2 fixes the following issues :

Security issues fixed :

CVE-2019-13616: Fixed heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c (bsc#1141844).

CVE-2019-13626: Fixed integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c (bsc#1142031).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MinGW cross compiled SDL 2.0.10, fixing a number of CVE issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for SDL2 fixes the following issues :

Security issues fixed :

  - CVE-2019-13616: Fixed heap-based buffer over-read in     BlitNtoN in video/SDL_blit_N.c (bsc#1141844).

  - CVE-2019-13626: Fixed integer overflow in     IMA_ADPCM_decode() in audio/SDL_wave.c (bsc#1142031).

This update was imported from the SUSE:SLE-15:Update update project.

The remote host is affected by the vulnerability described in GLSA-201909-07 (Simple DirectMedia Layer: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Simple DirectMedia       Layer. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted       audio or video, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
171377	Debian DLA-3314-1 : libsdl2 - LTS security update	Nessus	Debian Local Security Checks	high
138249	SUSE SLED15 / SLES15 Security Update : SDL2 (SUSE-SU-2019:2463-2)	Nessus	SuSE Local Security Checks	high
133587	Fedora 31 : mingw-SDL2 (2020-ff2fe47ba4)	Nessus	Fedora Local Security Checks	high
129486	openSUSE Security Update : SDL2 (openSUSE-2019-2226)	Nessus	SuSE Local Security Checks	high
129484	openSUSE Security Update : SDL2 (openSUSE-2019-2224)	Nessus	SuSE Local Security Checks	high
129383	SUSE SLED15 / SLES15 Security Update : SDL2 (SUSE-SU-2019:2463-1)	Nessus	SuSE Local Security Checks	high
128596	GLSA-201909-07 : Simple DirectMedia Layer: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2019-13626

medium

Tenable Plugins

high

high

high

high

high

high

high