Advisories » MGASA-2017-0397

Updated sdl2_image & mingw packages fix security vulnerability

Publication date: 02 Nov 2017
Modification date: 02 Nov 2017
Type: security
Affected Mageia releases : 5 , 6
CVE: CVE-2017-2887

Description

An exploitable buffer overflow vulnerability exists in the XCF property
handling functionality of SDL_image 2.0.1. A specially crafted xcf file
can cause a stack-based buffer overflow resulting in potential code
execution. An attacker can provide a specially crafted XCF file to
trigger this vulnerability (CVE-2017-2887).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=21881
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/C7QAEI2QV3QGJR5OS43R5U3U47LAHQRO/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2887

SRPMS

5/core

• sdl2_image-2.0.0-4.1.mga5

6/core

• sdl2_image-2.0.1-1.1.mga6
• mingw-SDL2_image-2.0.1-2.1.mga6