The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c. (CVE-2019-13616)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the SDL package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x     through 2.0.9 has a heap-based buffer overflow in     MS_ADPCM_decode in audio/SDL_wave.c.(CVE-2019-7575)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x     through 2.0.9 has a heap-based buffer over-read in     IMA_ADPCM_decode in audio/SDL_wave.c.(CVE-2019-7574)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x     through 2.0.9 has a buffer over-read in     IMA_ADPCM_nibble in audio/SDL_wave.c.(CVE-2019-7572)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x     through 2.0.9 has a heap-based buffer over-read in     BlitNtoN in video/SDL_blit_N.c when called from     SDL_SoftBlit in video/SDL_blit.c.(CVE-2019-13616)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the function SDL_InvalidateMap at video/SDL_pixels.c.(CVE-2019-12222)

A heap-based buffer overflow was discovered in SDL in the SDL_BlitCopy() function, that was called while copying an existing surface into a new optimized one, due to lack of validation while loading a BMP image in the SDL_LoadBMP_RW() function. An application that uses SDL to parse untrusted input files may be vulnerable to this flaw, which could allow an attacker to make the application crash or possibly execute code.(CVE-2019-13616)

A heap-based buffer overflow flaw, in SDL while copying an existing surface into a new optimized one, due to a lack of validation while loading a BMP image, is possible. An application that uses SDL to parse untrusted input files may be vulnerable to this flaw, which could allow an attacker to make the application crash or execute code.(CVE-2019-14906)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.(CVE-2019-13616)

A heap-based buffer overflow was discovered in SDL in the SDL_BlitCopy() function, that was called while copying an existing surface into a new optimized one, due to lack of validation while loading a BMP image in the SDL_LoadBMP_RW() function. An application that uses SDL to parse untrusted input files may be vulnerable to this flaw, which could allow an attacker to make the application crash or possibly execute code.(CVE-2019-13616)

Update to 2.0.10 to fix security issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3950 advisory.

    Simple DirectMedia Layer (SDL) is a cross-platform multimedia library designed to provide fast access to     the graphics frame buffer and audio device.

    Security Fix(es):

    * SDL: heap-based buffer overflow in SDL blit functions in video/SDL_blit*.c (CVE-2019-13616)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for SDL fixes the following issues :

Security issue fixed :

  - CVE-2019-13616: Fixed heap-based buffer over-read in     BlitNtoN in video/SDL_blit_N.c when called from     SDL_SoftBlit (bsc#1141844).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0293 advisory.

    Simple DirectMedia Layer (SDL) is a cross-platform multimedia library designed to provide fast access to     the graphics frame buffer and audio device.

    Security Fix(es):

    * SDL: heap-based buffer overflow in SDL blit functions in video/SDL_blit*.c (CVE-2019-13616)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0065 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-13616:
    SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2019-13616, CVE-2019-7572, CVE-2019-7572, CVE-2019-7573 CVE-2019-7576, CVE-2019-7574, CVE-2019-7575, CVE-2019-7577, CVE-2019-7577, CVE-2019-7578, CVE-2019-7635, CVE-2019-7637, CVE-2019-7638, CVE-2019-7636

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202305-17 (libsdl: Multiple Vulnerabilities)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in     IMA_ADPCM_nibble in audio/SDL_wave.c. (CVE-2019-7572)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef loop). (CVE-2019-7573)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     IMA_ADPCM_decode in audio/SDL_wave.c. (CVE-2019-7574)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in     MS_ADPCM_decode in audio/SDL_wave.c. (CVE-2019-7575)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop). (CVE-2019-7576)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in     SDL_LoadWAV_RW in audio/SDL_wave.c. (CVE-2019-7577)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitIMA_ADPCM in audio/SDL_wave.c. (CVE-2019-7578)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     Blit1to4 in video/SDL_blit_1.c. (CVE-2019-7635)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     SDL_GetRGB in video/SDL_pixels.c. (CVE-2019-7636)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     Map1toN in video/SDL_pixels.c. (CVE-2019-7638)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c. (CVE-2019-13616)

  - There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18     versions. By crafting a malicious .BMP file, an attacker can cause the application using this library to     crash, denial of service or Code execution. (CVE-2021-33657)

  - SDL v1.2 was discovered to contain a use-after-free via the XFree function at /src/video/x11/SDL_x11yuv.c.
    (CVE-2022-34568)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
258295	Linux Distros Unpatched Vulnerability : CVE-2019-13616	Nessus	Misc.	8/30/2025	7/12/2026	high
137959	EulerOS Virtualization 3.0.6.0 : SDL (EulerOS-SA-2020-1740)	Nessus	Huawei Local Security Checks	7/1/2020	3/5/2024	high
130215	Amazon Linux 2 : SDL2 (ALAS-2019-1318)	Nessus	Amazon Linux Local Security Checks	10/25/2019	4/17/2024	high
132263	Amazon Linux 2 : SDL (ALAS-2019-1375)	Nessus	Amazon Linux Local Security Checks	12/19/2019	4/3/2024	critical
129802	Fedora 29 : SDL2 (2019-8ef33a69ca)	Nessus	Fedora Local Security Checks	10/11/2019	4/18/2024	high
131298	RHEL 7 : SDL (RHSA-2019:3950)	Nessus	Red Hat Local Security Checks	11/26/2019	11/6/2024	high
142942	openSUSE Security Update : SDL (openSUSE-2020-1916)	Nessus	SuSE Local Security Checks	11/17/2020	2/8/2024	high
133385	RHEL 8 : SDL (RHSA-2020:0293)	Nessus	Red Hat Local Security Checks	1/31/2020	11/7/2024	high
239170	TencentOS Server 3: SDL (TSSA-2022:0065)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	high
133882	Fedora 31 : mingw-SDL (2020-24652fe41c)	Nessus	Fedora Local Security Checks	2/24/2020	3/26/2024	high
175061	GLSA-202305-17 : libsdl: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	5/3/2023	5/3/2023	high

Detections

Analytics

Plugins Search

high

high

high

critical

high

high

high

high

high

high

high