Component

Name

sdl

Version

1.2.15

Type

library

Description

Licenses

LGPL-2.1+

PURL

CPE

cpe:2.3:a:libsdl:simple_directmedia_layer:1.2.15:-:*:*:*:*:*:*

Other Versions#

Project

Branch

Version

buildroot

2025.02.x

1.2.15

Patches#

Title

Author

Resolve

Fix compilation with libX11 >= 1.5.99.902.

"Azamat H. Hackimov" <azamat.hackimov@gmail.com>

SDL_x11yuv.c: fix possible use-after-free

Ozkan Sezer <sezeroz@gmail.com>

CVE-2022-34568

Xext: Fix function declarations without a prototype

orbea <orbea@riseup.net>

src/stdlib/SDL_iconv.c: fix types mismatch

Giulio Benetti <giulio.benetti@benettiengineering.com>

Vulnerabilities#

Name

Analysis

Description

CVE-2022-34568

Patched

SDL v1.2 was discovered to contain a use-after-free via the XFree function at /src/video/x11/SDL_x11yuv.c.

CVE-2019-7638

Exploitable

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Map1toN in video/SDL_pixels.c.

CVE-2019-7637

Exploitable

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in SDL_FillRect in video/SDL_surface.c.

CVE-2019-7636

Exploitable

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c.

CVE-2019-7635

Exploitable

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.

CVE-2019-7578

Exploitable

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.

CVE-2019-7577

Exploitable

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c.

CVE-2019-7576

Exploitable

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop).

CVE-2019-7575

Exploitable

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.

CVE-2019-7574

Exploitable

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c.

CVE-2019-7573

Exploitable

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef loop).

CVE-2019-7572

Exploitable

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.

CVE-2019-14906

Exploitable

A flaw was found with the RHSA-2019:3950 erratum, where it did not fix the CVE-2019-13616 SDL vulnerability. This issue only affects Red Hat SDL packages, SDL versions through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow flaw while copying an existing surface into a new optimized one, due to a lack of validation while loading a BMP image, is possible. An application that uses SDL to parse untrusted input files may be vulnerable to this flaw, which could allow an attacker to make the application crash or execute code.

CVE-2019-13616

Exploitable

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.