MGASA-2018-0454 - Updated sdl2/mingw-SDL2 packages fix security vulnerabilities

Publication date: 17 Nov 2018
URL: https://advisories.mageia.org/MGASA-2018-0454.html
Type: security
Affected Mageia releases: 6
CVE: CVE-2017-12122,
     CVE-2017-14440,
     CVE-2017-14441,
     CVE-2017-14442,
     CVE-2017-14448,
     CVE-2017-14449,
     CVE-2017-14450,
     CVE-2018-3837,
     CVE-2018-3838,
     CVE-2018-3839,
     CVE-2018-3977

This update fixes various security vulnerabilities affecting the
SDL2_image library, listed below. The fixes are provided in SDL2_image
2.0.4, which depends on SDL2 2.0.8 or later. As such, the SDL2 and
SDL2_mixer libraries are also updated to their current stable releases,
providing various bug fixes and features.

The security vulnerabilities fixed in this update are the following:

An exploitable code execution vulnerability exists in the ILBM image
rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM
image can cause a heap overflow resulting in code execution. An attacker
can display a specially crafted image to trigger this vulnerability.
(TALOS-2017-0488, CVE-2017-12122)

An exploitable code execution vulnerability exists in the ILBM image
rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM
image can cause a stack overflow resulting in code execution. An
attacker can display a specially crafted image to trigger this
vulnerability. (TALOS-2017-0489, CVE-2017-14440)

An exploitable code execution vulnerability exists in the ICO image
rendering functionality of SDL2_image-2.0.2. A specially crafted ICO
image can cause an integer overflow, cascading to a heap overflow
resulting in code execution. An attacker can display a specially crafted
image to trigger this vulnerability. (TALOS-2017-0490, CVE-2017-14441)

An exploitable code execution vulnerability exists in the BMP image
rendering functionality of SDL2_image-2.0.2. A specially crafted BMP
image can cause a stack overflow resulting in code execution. An
attacker can display a specially crafted image to trigger this
vulnerability. (TALOS-2017-0491, CVE-2017-14442)

An exploitable code execution vulnerability exists in the XCF image
rendering functionality of SDL2_image-2.0.2. A specially crafted XCF
image can cause a heap overflow resulting in code execution. An
attacker can display a specially crafted image to trigger this
vulnerability. (TALOS-2017-0497, CVE-2017-14448)

A double-Free vulnerability exists in the XCF image rendering
functionality of SDL2_image-2.0.2. A specially crafted XCF image can
cause a Double-Free situation to occur. An attacker can display a
specially crafted image to trigger this vulnerability.
(TALOS-2017-0498, CVE-2017-14449)

A buffer overflow vulnerability exists in the GIF image parsing
functionality of SDL2_image-2.0.2. A specially crafted GIF image can
lead to a buffer overflow on a global section. An attacker can display
an image to trigger this vulnerability. (TALOS-2017-0499,
CVE-2017-14450)

An exploitable information disclosure vulnerability exists in the PCX
image rendering functionality of SDL2_image-2.0.2. A specially crafted
PCX image can cause an out-of-bounds read on the heap, resulting in
information disclosure. An attacker can display a specially crafted
image to trigger this vulnerability. (TALOS-2018-0519, CVE-2018-3837)

An exploitable information vulnerability exists in the XCF image
rendering functionality of SDL2_image-2.0.2. A specially crafted XCF
image can cause an out-of-bounds read on the heap, resulting in
information disclosure. An attacker can display a specially crafted
image to trigger this vulnerability. (TALOS-2018-0520, CVE-2018-3838)

An exploitable code execution vulnerability exists in the XCF image
rendering functionality of SDL2_image-2.0.2. A specially crafted XCF
image can cause an out-of-bounds write on the heap, resulting in code
execution. An attacker can display a specially crafted image to trigger
this vulnerability. (TALOS-2018-0521, CVE-2018-3839)

An exploitable code execution vulnerability exists in the XCF image
rendering functionality of SDL2_image-2.0.3. A specially crafted XCF
image can cause a heap overflow, resulting in code execution. An
attacker can display a specially crafted image to trigger this
vulnerability. (TALOS-2018-0645, CVE-2018-3977)

References:
- https://bugs.mageia.org/show_bug.cgi?id=22769
- https://talosintelligence.com/vulnerability_reports/TALOS-2017-0488
- https://talosintelligence.com/vulnerability_reports/TALOS-2017-0489
- https://talosintelligence.com/vulnerability_reports/TALOS-2017-0490
- https://talosintelligence.com/vulnerability_reports/TALOS-2017-0491
- https://talosintelligence.com/vulnerability_reports/TALOS-2017-0497
- https://talosintelligence.com/vulnerability_reports/TALOS-2017-0498
- https://talosintelligence.com/vulnerability_reports/TALOS-2017-0499
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0519
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0520
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0521
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0645
- https://github.com/libsdl-org/SDL/blob/c49ecf6f7c10b668ebd87b89dfc3c7bfd215cb75/WhatsNew.txt
- https://www.libsdl.org/projects/SDL_image/
- https://www.libsdl.org/projects/SDL_mixer/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12122
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14440
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14441
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14442
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14448
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14449
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14450
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3837
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3838
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3839
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3977

SRPMS:
- 6/core/sdl2-2.0.9-1.mga6
- 6/core/sdl2_image-2.0.4-1.mga6
- 6/core/sdl2_mixer-2.0.4-1.mga6
- 6/core/mingw-SDL2-2.0.9-1.mga6
- 6/core/mingw-SDL2_image-2.0.4-1.mga6
- 6/core/mingw-SDL2_mixer-2.0.4-1.mga6