Out-of-bounds read in Simple DirectMedia Layer - CVE-2018-3837

Vulnerability identifier: #VU12121

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-3837

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists in the PCX image rendering functionality due to out-of-bounds read on the heap. A remote attacker can display a specially crafted PCX image, trick the victim into opening it and gain access to potentially sensitive information.

Simple DirectMedia Layer
Debian Linux
Gentoo Linux
Fedora
sdl2_image (Alpine package)
SDL2_gfx
SDL2_mixer
SDL2_image
mingw-SDL2_image
mingw-SDL2_mixer
SDL2
mingw-SDL2

Install update from vendor's website.

sdl2_image (Alpine package) - update to 2.0.1-r2
SDL2_gfx - update to 1.0.3-1.el7
SDL2_mixer - update to 2.0.2-2.el7
SDL2_image - addressed in versions 2.0.3-1.el7, 2.0.4-1.el7, 2.0.4-1.fc28, 2.0.4-1.fc29
mingw-SDL2_image - addressed in versions 2.0.4-1.el7, 2.0.4-1.fc28, 2.0.4-1.fc29
mingw-SDL2_mixer - update to 2.0.4-1.el7
SDL2 - update to 2.0.8-5.el7
mingw-SDL2 - update to 2.0.9-1.el7

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-3837

• Debian update for libsdl2-image
• Debian update for sdl-image1.2
• Gentoo update for SDL2_Image
• Out-of-bounds read in sdl2_image (Alpine package)
• Fedora EPEL 7 update for SDL2, SDL2_gfx, SDL2_image, SDL2_mixer
• Fedora 28 update for SDL2_image
• Fedora 29 update for SDL2_image
• Fedora EPEL 7 update for SDL2_image
• Fedora 28 update for mingw-SDL2_image
• Fedora 29 update for mingw-SDL2_image
• Fedora EPEL 7 update for mingw-SDL2, mingw-SDL2_image, mingw-SDL2_mixer