CVE-2019-5052

Published: Jul 3, 2019Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A specially crafted file can cause an integer overflow, resulting in too little memory being allocated, which can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.

Affected (8)

Products: Libsdl: Sdl2 Image · Debian: Debian Linux · Opensuse: Backports Sle, Leap · +1 more

Show all products

Libsdl: Sdl2 Image · Debian: Debian Linux · Opensuse: Backports Sle, Leap · Canonical: Ubuntu Linux

1 product

1 product

2 products

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libsdl Sdl2 Image	Version 2.0.4

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Opensuse Backports Sle	Version 15.0
Opensuse Backports Sle	Version 15.0 sp1
Opensuse Leap	Version 15.0
Opensuse Leap	Version 15.1

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04

Related CWEs

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (16)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html

Source: talos-cna@cisco.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html

Source: talos-cna@cisco.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html

Source: talos-cna@cisco.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html

Source: talos-cna@cisco.com

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2019/07/msg00021.html

Source: talos-cna@cisco.com

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html

Source: talos-cna@cisco.com

Mailing ListThird Party Advisory

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0821

Source: talos-cna@cisco.com

ExploitThird Party Advisory

https://usn.ubuntu.com/4238-1/

Source: talos-cna@cisco.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2019/07/msg00021.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0821

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://usn.ubuntu.com/4238-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.