Heap-based buffer overflow in openSUSE Leap - CVE-2017-14448

Vulnerability identifier: #VU11248

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-14448

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in the XCF image rendering functionality due to heap-based buffer overflow. A remote attacker can send a specially crafted image, trick the victim into opening it and execute arbitrary code.

openSUSE Leap
sdl2_image (Alpine package)
SDL2_gfx
SDL2_mixer
SDL2_image
SDL2
Debian Linux
Gentoo Linux
Fedora

Install update from vendor's website.

sdl2_image (Alpine package) - update to 2.0.1-r2
SDL2_gfx - update to 1.0.3-1.el7
SDL2_mixer - update to 2.0.2-2.el7
SDL2_image - update to 2.0.3-1.el7
SDL2 - update to 2.0.8-5.el7

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-14448

• OpenSUSE Linux update for SDL2
• Debian update for libsdl2-image
• Debian update for sdl-image1.2
• Gentoo update for SDL2_Image
• Heap-based buffer overflow in sdl2_image (Alpine package)
• Fedora EPEL 7 update for SDL2, SDL2_gfx, SDL2_image, SDL2_mixer