CVE-2019-14906 Memory corruption in SDL
Heap-based buffer overflow in SDL allows attackers to execute code or crash applications via malicious BMP files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-14906?
CVE-2019-14906 is a high-severity memory corruption vulnerability in Redhat Enterprise Linux, published on 7 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found with the RHSA-2019:3950 erratum, where it did not fix the CVE-2019-13616 SDL vulnerability. This issue only affects Red Hat SDL packages, SDL versions through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow flaw while copying an existing surface into a new optimized one, due to a lack of validation while loading a BMP image, is possible. An application that uses SDL to parse untrusted input files may be vulnerable to this flaw, which could allow an attacker to make the application crash or execute code.
Which versions are affected by CVE-2019-14906?
It affects 2 products.
Linux distribution packages (16)
SDL Red Hat:enterprise_linux:7::client | All versions | 0:1.2.15-15.el7_7 |
SDL-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:1.2.15-15.el7_7 |
SDL-devel Red Hat:enterprise_linux:7::client | All versions | 0:1.2.15-15.el7_7 |
SDL-static Red Hat:enterprise_linux:7::client | All versions | 0:1.2.15-15.el7_7 |
SDL Red Hat:enterprise_linux:7::computenode | All versions | 0:1.2.15-15.el7_7 |
SDL-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:1.2.15-15.el7_7 |
SDL-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:1.2.15-15.el7_7 |
SDL-static Red Hat:enterprise_linux:7::computenode | All versions | 0:1.2.15-15.el7_7 |
SDL Red Hat:enterprise_linux:7::server | All versions | 0:1.2.15-15.el7_7 |
SDL-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:1.2.15-15.el7_7 |
SDL-devel Red Hat:enterprise_linux:7::server | All versions | 0:1.2.15-15.el7_7 |
SDL-static Red Hat:enterprise_linux:7::server | All versions | 0:1.2.15-15.el7_7 |
SDL Red Hat:enterprise_linux:7::workstation | All versions | 0:1.2.15-15.el7_7 |
SDL-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:1.2.15-15.el7_7 |
SDL-devel Red Hat:enterprise_linux:7::workstation | All versions | 0:1.2.15-15.el7_7 |
SDL-static Red Hat:enterprise_linux:7::workstation | All versions | 0:1.2.15-15.el7_7 |
Products include Libsdl Simple Directmedia Layer, Redhat Enterprise Linux.
How do I fix CVE-2019-14906?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-14906 being exploited?
There is no known exploitation of CVE-2019-14906 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
Sources
Also known as GHSA-2w82-mm6w-3vc9, RHSA-2019:4024.