{"affected":[{"ecosystem_specific":{"binaries":[{"SDL_image":"1.2.6-84.42.1","SDL_image-devel":"1.2.6-84.42.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","name":"SDL_image","purl":"pkg:rpm/suse/SDL_image&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.2.6-84.42.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for SDL_image fixes the following issues:\n\n- CVE-2017-14442: A specially crafted BMP image could have caused a stack overflow for an attacker that can display a specially crafted image (bsc#1084304).\n- CVE-2017-14450: A specially crafted GIF image could have caused a buffer overflow on a global section for an attacker that can display an image (bsc#1084288).\n- CVE-2017-12122: An exploitable code execution vulnerability exists in the ILBM image rendering functionality. A specially crafted ILBM image can cause a heap overflow resulting in code execution. (bsc#1084256).\n- CVE-2017-14440: An exploitable code execution vulnerability exists in the ILBM image rendering functionality. A specially crafted ILBM image can cause a stack overflow resulting in code execution. (bsc#1084257).\n- CVE-2017-14448: An exploitable code execution vulnerability exists in the XCF image rendering functionality. A specially crafted XCF image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability. (bsc#1084303).\n- CVE-2018-3839: An exploitable code execution vulnerability exists in the XCF image rendering functionality. A specially crafted XCF image can cause an out-of-bounds write on the heap, resulting in code execution. (bsc#1089087).\n\n","id":"SUSE-SU-2018:3657-1","modified":"2018-11-07T15:19:23Z","published":"2018-11-07T15:19:23Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183657-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1084256"},{"type":"REPORT","url":"https://bugzilla.suse.com/1084257"},{"type":"REPORT","url":"https://bugzilla.suse.com/1084288"},{"type":"REPORT","url":"https://bugzilla.suse.com/1084303"},{"type":"REPORT","url":"https://bugzilla.suse.com/1084304"},{"type":"REPORT","url":"https://bugzilla.suse.com/1089087"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-12122"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-14440"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-14442"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-14448"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-14450"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-3839"}],"related":["CVE-2017-12122","CVE-2017-14440","CVE-2017-14442","CVE-2017-14448","CVE-2017-14450","CVE-2018-3839"],"summary":"Security update for SDL_image","upstream":["CVE-2017-12122","CVE-2017-14440","CVE-2017-14442","CVE-2017-14448","CVE-2017-14450","CVE-2018-3839"]}