{"id":"SUSE-SU-2018:3657-1","summary":"Security update for SDL_image","details":"This update for SDL_image fixes the following issues:\n\n- CVE-2017-14442: A specially crafted BMP image could have caused a stack overflow for an attacker that can display a specially crafted image (bsc#1084304).\n- CVE-2017-14450: A specially crafted GIF image could have caused a buffer overflow on a global section for an attacker that can display an image (bsc#1084288).\n- CVE-2017-12122: An exploitable code execution vulnerability exists in the ILBM image rendering functionality. A specially crafted ILBM image can cause a heap overflow resulting in code execution. (bsc#1084256).\n- CVE-2017-14440: An exploitable code execution vulnerability exists in the ILBM image rendering functionality. A specially crafted ILBM image can cause a stack overflow resulting in code execution. (bsc#1084257).\n- CVE-2017-14448: An exploitable code execution vulnerability exists in the XCF image rendering functionality. A specially crafted XCF image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (bsc#1084303).\n- CVE-2018-3839: An exploitable code execution vulnerability exists in the XCF image rendering functionality. A specially crafted XCF image can cause an out-of-bounds write on the heap, resulting in code execution. (bsc#1089087).\n\n","modified":"2026-03-11T07:00:10.087713Z","published":"2018-11-07T15:19:23Z","related":["CVE-2017-12122","CVE-2017-14440","CVE-2017-14442","CVE-2017-14448","CVE-2017-14450","CVE-2018-3839"],"upstream":["CVE-2017-12122","CVE-2017-14440","CVE-2017-14442","CVE-2017-14448","CVE-2017-14450","CVE-2018-3839"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183657-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1084256"},{"type":"REPORT","url":"https://bugzilla.suse.com/1084257"},{"type":"REPORT","url":"https://bugzilla.suse.com/1084288"},{"type":"REPORT","url":"https://bugzilla.suse.com/1084303"},{"type":"REPORT","url":"https://bugzilla.suse.com/1084304"},{"type":"REPORT","url":"https://bugzilla.suse.com/1089087"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-12122"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-14440"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-14442"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-14448"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-14450"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-3839"}],"affected":[{"package":{"name":"SDL_image","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","purl":"pkg:rpm/suse/SDL_image&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-84.42.1"}]}],"ecosystem_specific":{"binaries":[{"SDL_image":"1.2.6-84.42.1","SDL_image-devel":"1.2.6-84.42.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2018:3657-1.json"}}],"schema_version":"1.7.5"}