An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image     2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating     too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow,     ultimately ending in code execution. An attacker can display a specially crafted image to trigger this     vulnerability. (CVE-2019-5060)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image
    2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating
    too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow,
    ultimately ending in code execution. An attacker can display a specially crafted image to trigger this
    vulnerability. (CVE-2019-5060)

  - An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image,
    version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An
    attacker can provide a specially crafted image file to trigger this vulnerability. (CVE-2019-5051)

  - An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A
    specially crafted file can cause an integer overflow, resulting in too little memory being allocated,
    which can lead to a buffer overflow and potential code execution. An attacker can provide a specially
    crafted image file to trigger this vulnerability. (CVE-2019-5052)

  - An exploitable code execution vulnerability exists in the PCX image-rendering functionality of SDL2_image
    2.0.4. A specially crafted PCX image can cause a heap overflow, resulting in code execution. An attacker
    can display a specially crafted image to trigger this vulnerability. (CVE-2019-5057)

  - An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image
    2.0.4. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker
    can display a specially crafted image to trigger this vulnerability. (CVE-2019-5058)

This update for SDL_image fixes the following issues :

Update SDL_Image to new snapshot 1.2.12+hg695.

Security issues fixed :

  - TALOS-2019-0821 CVE-2019-5052: exploitable integer     overflow vulnerability when loading a PCX file     (boo#1140421)

  - TALOS-2019-0841 CVE-2019-5057: code execution     vulnerability in the PCX image-rendering functionality     of SDL2_image (boo#1143763)

  - TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF     image rendering can lead to code execution (boo#1143764)

  - TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM     image handling (boo#1143766)

  - TALOS-2019-0844 CVE-2019-5060: integer overflow in the     XPM image (boo#1143768)

  - CVE-2019-7635: heap-based buffer over-read in Blit1to4     in video/SDL_blit_1.c (boo#1124827)

  - CVE-2019-13616: fix heap buffer overflow when reading a     crafted bmp file (boo#1141844).

This update for SDL2_image fixes the following issues :

Update to new upstream release 2.0.5.

Security issues fixed :

  - TALOS-2019-0820 CVE-2019-5051: exploitable heap-based     buffer overflow vulnerability when loading a PCX file     (boo#1140419)

  - TALOS-2019-0821 CVE-2019-5052: exploitable integer     overflow vulnerability when loading a PCX file     (boo#1140421)

  - TALOS-2019-0841 CVE-2019-5057: code execution     vulnerability in the PCX image-rendering functionality     of SDL2_image (boo#1143763)

  - TALOS-2019-0842 CVE-2019-5058: heap overflow in XCF     image rendering can lead to code execution (boo#1143764)

  - TALOS-2019-0843 CVE-2019-5059: heap overflow in XPM     image (boo#1143766)

  - TALOS-2019-0844 CVE-2019-5060: integer overflow in the     XPM image (boo#1143768)

Not mentioned by upstream, but issues seemingly further fixed :

  - CVE-2019-12218: NULL pointer dereference in the     SDL2_image function IMG_LoadPCX_RW (boo#1135789)

  - CVE-2019-12217: NULL pointer dereference in the SDL     stdio_read function (boo#1135787)

  - CVE-2019-12220: SDL_image triggers an out-of-bounds read     in the SDL function SDL_FreePalette_REAL (boo#1135806)

  - CVE-2019-12221: a SEGV caused by SDL_image in SDL     function SDL_free_REAL in stdlib/SDL_malloc.c     (boo#1135796)

  - CVE-2019-12222: out-of-bounds read triggered by     SDL_image in the function SDL_InvalidateMap at     video/SDL_pixels.c (boo#1136101)

  - CVE-2019-13616: fix heap buffer overflow when reading a     crafted bmp file (boo#1141844).

SDL_image developers report :

Fixed a number of security issues :

- TALOS-2019-0820

- TALOS-2019-0821

- TALOS-2019-0841

- TALOS-2019-0842

- TALOS-2019-0843

- TALOS-2019-0844

ID	Name	Product	Family	Severity
250639	Linux Distros Unpatched Vulnerability : CVE-2019-5060	Nessus	Misc.	high
407152	Alpine: multiple sdl2_image packages: security update to 2.0.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407152	Alpine: multiple sdl2_image packages: security update to 2.0.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
128540	openSUSE Security Update : SDL_image (openSUSE-2019-2071)	Nessus	SuSE Local Security Checks	high
128539	openSUSE Security Update : SDL2_image (openSUSE-2019-2070)	Nessus	SuSE Local Security Checks	high
126484	FreeBSD : SDL2_image -- multiple vulnerabilities (3394bc2b-9da4-11e9-951e-14dae9d5a9d2)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2019-5060

high

Tenable Plugins

high

high

high

high

high

high