CVE-2019-13626 — Out-of-bounds Read in Libsdl1.2

CWE-125 — Out-of-bounds ReadCWE-190 — Integer Overflow or Wraparound11 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
1.2%
top 20.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Debian Libsdl1.2Debian Libsdl2Libsdl+3 more
Timeline
PublishedJul 17
Latest updateMay 24

Description

SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buffer over-read in Fill_IMA_ADPCM_block, caused by an integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/libsdl2< libsdl2 2.0.10+dfsg1-1 (bookworm)
▶debiandebian/libsdl1.2< libsdl2 2.0.10+dfsg1-1 (bookworm)
▶NVDlibsdl/libsdl2.0.0 — 2.0.9
▶NVDopensuse/leap15.0, 15.1+1

Also affects: Debian Linux 10.0, Fedora 31

🔴Vulnerability Details

2
GHSA
GHSA-cfw8-jr6q-wg89: SDL (Simple DirectMedia Layer) 2↗2022-05-24
▶
OSV
CVE-2019-13626: SDL (Simple DirectMedia Layer) 2↗2019-07-17
▶

📋Vendor Advisories

2
Red Hat
SDL: integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c leads to heap-based buffer over-read in Fill_IMA_ADPCM_block↗2019-07-17
▶
Debian
CVE-2019-13626: libsdl1.2 - SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buffer over-re...↗2019
▶

💬Community

6
Bugzilla
CVE-2019-13626 mingw-SDL2: SDL: integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c leads to heap-based buffer over-read in Fill_IMA_ADPCM_block [epel-all]↗2019-09-23
▶
Bugzilla
CVE-2019-13626 mingw-SDL2: SDL: integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c leads to heap-based buffer over-read in Fill_IMA_ADPCM_block [fedora-all]↗2019-09-23
▶
Bugzilla
CVE-2019-13626 SDL2: SDL: integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c leads to heap-based buffer over-read in Fill_IMA_ADPCM_block [fedora-all]↗2019-09-23
▶
Bugzilla
CVE-2019-13626 SDL2: SDL: integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c leads to heap-based buffer over-read in Fill_IMA_ADPCM_block [epel-all]↗2019-09-23
▶
Bugzilla
CVE-2019-13626 SDL: integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c leads to heap-based buffer over-read in Fill_IMA_ADPCM_block↗2019-07-18
▶