Out-of-bounds write in Simple DirectMedia Layer - CVE-2021-33657

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU62729

Out-of-bounds write in Simple DirectMedia Layer - CVE-2021-33657

Published: May 2, 2022


Vulnerability identifier: #VU62729
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-33657
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing .BMP files in video/SDL_pixels.c. A remote attacker can create a specially crafted BMP file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.


Affected software

Simple DirectMedia Layer
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Server
Oracle Solaris
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
Slackware Linux
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Desktop
openSUSE Leap
openEuler
SUSE Linux Enterprise Module for Packagehub Subpackages
SDL-debuginfo-32bit
SDL-debugsource
SDL
SDL-32bit
SDL-debuginfo
sdl
libsdl1.2debian (Ubuntu package)
libSDL-devel
libSDL-1_2-0-debuginfo-32bit
libSDL-1_2-0-debuginfo
libSDL-1_2-0-32bit
libSDL-1_2-0
SDL2-debuginfo
SDL2-devel
SDL2-debugsource
SDL2
libSDL2-devel
libSDL2-2_0-0-debuginfo
libSDL2-2_0-0
libSDL2-devel-32bit
libSDL2-2_0-0-32bit
libSDL2-2_0-0-32bit-debuginfo
libsdl2-2.0-0 (Ubuntu package)
media-libs/libsdl2

How to mitigate CVE-2021-33657

Install updates from vendor's website.

Simple DirectMedia Layer - update to 2.0.22
SDL-debuginfo-32bit - update to 1.2.13-106.21.1
SDL-debugsource - addressed in versions 1.2.13-106.21.1, 1.2.15-15.17.1
SDL - update to 1.2.13-106.21.1
SDL-32bit - update to 1.2.13-106.21.1
SDL-debuginfo - update to 1.2.13-106.21.1
sdl - update to 1.2.15
libsdl1.2debian (Ubuntu package) - update to 1.2.15+dfsg2-0.1ubuntu0.2
libSDL-devel - update to 1.2.15-15.17.1
libSDL-1_2-0-debuginfo-32bit - update to 1.2.15-15.17.1
libSDL-1_2-0-debuginfo - update to 1.2.15-15.17.1
libSDL-1_2-0-32bit - update to 1.2.15-15.17.1
libSDL-1_2-0 - update to 1.2.15-15.17.1
SDL2-debuginfo - update to 2.0.8-11
SDL2-devel - update to 2.0.8-11
SDL2-debugsource - update to 2.0.8-11
SDL2 - update to 2.0.8-11
SDL2-debugsource - addressed in versions 2.0.8-150000.3.21.1, 2.0.8-150200.11.6.1
libSDL2-devel - addressed in versions 2.0.8-150000.3.21.1, 2.0.8-150200.11.6.1
libSDL2-2_0-0-debuginfo - addressed in versions 2.0.8-150000.3.21.1, 2.0.8-150200.11.6.1
libSDL2-2_0-0 - addressed in versions 2.0.8-150000.3.21.1, 2.0.8-150200.11.6.1
libSDL2-devel-32bit - update to 2.0.8-150200.11.6.1
libSDL2-2_0-0-32bit - update to 2.0.8-150200.11.6.1
libSDL2-2_0-0-32bit-debuginfo - update to 2.0.8-150200.11.6.1
libsdl2-2.0-0 (Ubuntu package) - update to 2.0.14+dfsg2-3ubuntu0.1
media-libs/libsdl2 - update to 2.26.0

External References

Related Security Bulletins