Back to CVE Browser

CVE-2018-3839

HIGH

8.8

CVSS Severity Score

EPSS Score0.0960%

EPSS Percentile36.80th

PublishedApr 10, 2018

Last ModifiedNov 21, 2024

Vulnerability Description

An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

Affected Platforms (CPE)

📦

Libsdl

Sdl Image

= 2.0.2

💻

Debian

Debian Linux

= 8.0

💻

Debian

Debian Linux

= 9.0

📦

Starwindsoftware

Starwind Virtual San

= v8

📦

Starwindsoftware

Starwind Virtual San

= v8

📦

Starwindsoftware

Starwind Virtual San

= v8

References & Advisories

🔗 https://security.gentoo.org/glsa/201903-17

🔗 https://www.debian.org/security/2018/dsa-4177

🔗 https://www.debian.org/security/2018/dsa-4184

🔗 https://www.starwindsoftware.com/security/sw-20191008-0002/

🔗 https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0521

🔗 https://security.gentoo.org/glsa/201903-17

🔗 https://www.debian.org/security/2018/dsa-4177

🔗 https://www.debian.org/security/2018/dsa-4184

Related Vulnerabilities

CVE-2008-054410.0

Heap-based buffer overflow in the IMG_LoadLBM_RW function in IMG_lbm.c in SDL_image before 1.2.7 allows remote attackers to cause ...

CVE-2019-149069.8

A flaw was found with the RHSA-2019:3950 erratum, where it did not fix the CVE-2019-13616 SDL vulnerability. This issue only affec...

CVE-2017-28878.8

An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially cra...

CVE-2017-28888.8

An exploitable integer overflow vulnerability exists when creating a new RGB Surface in SDL 2.0.5. A specially crafted file can ca...