vulnwire
8.1high

CVE-2019-7635

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.

Published 7 y ago · modified 4 mo ago · JSON

CVSS
8.1
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
3.5%
percentile 89%
Public exploits
0
none known

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.

Exploit prediction (EPSS)

3.54% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.18.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
NVD2.05.8AV:N/AC:M/Au:N/C:P/I:N/A:P

Classification

Weakness

References

  • lists.debian.org /debian-lts-announce/2019/03/msg00016.html · mailing-list, x_transferred
  • bugzilla.libsdl.org /show_bug.cgi?id=4498 · x_transferred
  • lists.debian.org /debian-lts-announce/2019/03/msg00015.html · mailing-list, x_transferred
  • discourse.libsdl.org /t/vulnerabilities-found-in-libsdl-1-2-15/25720 · x_transferred
  • lists.opensuse.org /opensuse-security-announce/2019-04/msg00063.html · vendor-advisory, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2019-04/msg00073.html · vendor-advisory, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2019-04/msg00088.html · vendor-advisory, x_transferred
  • lists.debian.org /debian-lts-announce/2019/07/msg00021.html · mailing-list, x_transferred
  • lists.debian.org /debian-lts-announce/2019/07/msg00026.html · mailing-list, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2019-09/msg00014.html · vendor-advisory, x_transferred
  • security.gentoo.org /glsa/201909-07 · vendor-advisory, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2019-09/msg00030.html · vendor-advisory, x_transferred
  • usn.ubuntu.com /4143-1/ · vendor-advisory, x_transferred
  • usn.ubuntu.com /4156-1/ · vendor-advisory, x_transferred
  • usn.ubuntu.com /4156-2/ · vendor-advisory, x_transferred
  • lists.debian.org /debian-lts-announce/2019/10/msg00021.html · mailing-list, x_transferred
  • lists.debian.org /debian-lts-announce/2019/10/msg00020.html · mailing-list, x_transferred
  • usn.ubuntu.com /4238-1/ · vendor-advisory, x_transferred
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTH · vendor-advisory, x_transferred
  • lists.debian.org /debian-lts-announce/2021/01/msg00024.html · mailing-list, x_transferred
  • lists.debian.org /debian-lts-announce/2021/10/msg00032.html · mailing-list, x_transferred
  • lists.debian.org /debian-lts-announce/2023/02/msg00008.html · mailing-list, x_transferred
  • security.gentoo.org /glsa/202305-17 · vendor-advisory, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.