CVE-2018-3838 — Out-of-bounds Read in Systems INC Simple Directmedia

CWE-125 — Out-of-bounds ReadCWE-200 — Sensitive Information ExposureCWE-648 — Incorrect Use of Privileged APIs11 documents7 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 37.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco Systems INC Simple DirectmediaDebian LinuxLibsdl SDL Image
Timeline
PublishedApr 10
Latest updateMay 13

Description

An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds read on the heap, resulting in information disclosure. An attacker can display a specially crafted image to trigger this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDlibsdl/sdl_image2.0.2
▶CVEListV5cisco_systems_inc/simple_directmediaSimple DirectMedia Layer SDL2_image 2.0.2

Also affects: Debian Linux 8.0, 9.0

🔴Vulnerability Details

3
GHSA
GHSA-mh87-4cjg-xvmr: An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2↗2022-05-13
▶
CVEList
CVE-2018-3838: An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2↗2018-04-10
▶
OSV
CVE-2018-3838: An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2↗2018-04-10
▶

📋Vendor Advisories

2
Red Hat
ghostscript: forceput in DefineResource is still accessible (700576)↗2019-03-21
▶
Debian
CVE-2018-3838: libsdl2-image - An exploitable information vulnerability exists in the XCF image rendering funct...↗2018
▶

💬Community

5
Bugzilla
CVE-2019-3838 ghostscript: forceput in DefineResource is still accessible (700576)↗2019-02-15
▶
Bugzilla
CVE-2018-3837 CVE-2018-3838 CVE-2018-3839 mingw-SDL2_image: various flaws [fedora-all]↗2018-04-16
▶
Bugzilla
CVE-2018-3838 SDL2_image: information disclosure in the XCF image rendering functionality↗2018-04-16
▶
Bugzilla
CVE-2018-3837 CVE-2018-3838 CVE-2018-3839 SDL2_image: various flaws [epel-7]↗2018-04-16
▶
Bugzilla
CVE-2018-3837 CVE-2018-3838 CVE-2018-3839 SDL2_image: various flaws [fedora-all]↗2018-04-16
▶
CVE-2018-3838 — Out-of-bounds Read | cvebase