Advisories » MGASA-2017-0398

Updated sdl2 packages fix security vulnerability

Publication date: 02 Nov 2017
Modification date: 02 Nov 2017
Type: security
Affected Mageia releases : 5 , 6
CVE: CVE-2017-2888

Description

Yves Younan of Cisco Talos discovered an exploitable integer overflow
vulnerability when creating a new RGB Surface in SDL 2.0.x before
version 2.0.7. A specially crafted file can cause an integer overflow
resulting in too little memory being allocated which can lead to a
buffer overflow and potential code execution. An attacker can provide a
specially crafted image file to trigger this vulnerability
(CVE-2017-2888).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=21882
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0395
• http://hg.libsdl.org/SDL/rev/7e0f1498ddb5
• http://hg.libsdl.org/SDL/rev/81a4950907a0
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2888

SRPMS

6/core

• sdl2-2.0.5-2.1.mga6
• mingw-SDL2-2.0.5-1.mga6

5/core

• sdl2-2.0.3-4.1.mga5