CVE-2019-5059

HIGH

SDL2_image 2.0.4 - Integer Overflow to Heap Buffer Overflow via XPM Image Rendering

Title source: llm

Description

An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow, allocating too small of a buffer. This buffer can then be written out of bounds resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

References (5)

Core 5

Core References

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html

Third Party Advisory x_refsource_misc

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0843

Scores

CVSS v3 8.8

EPSS 0.0097

EPSS Percentile 76.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-190 CWE-787

Status published

Products (4)

libsdl/sdl2_image 2.0.4

opensuse/backports_sle 15.0 (2 CPE variants)

opensuse/leap 15.0

opensuse/leap 15.1

Published Jul 31, 2019

Tracked Since Feb 18, 2026