libsdl2-image: multiple security issues

Debian Bug report logs - #932754
libsdl2-image: multiple security issues

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Hugo Lefeuvre <hle@debian.org>

To: submit@bugs.debian.org

Subject: libsdl2-image: multiple security issues

Date: Mon, 22 Jul 2019 15:40:17 -0300

[Message part 1 (text/plain, inline)]

Source: libsdl2-image
Version: 2.0.4+dfsg1-1
Severity: important
Tags: security upstream

Hi,

the following security issues[0] were published for libsdl2-image:

* CVE-2019-5052: integer overflow and subsequent buffer overflow in IMG_pcx.c.

* CVE-2019-5051: heap-based buffer overflow in IMG_pcx.c.

* CVE-2019-7635: heap buffer overflow in Blit1to4 (IMG_bmp.c).

* CVE-2019-12216, CVE-2019-12217,
  CVE-2019-12218, CVE-2019-12219,
  CVE-2019-12220, CVE-2019-12221,
  CVE-2019-12222: OOB R/W in IMG_LoadPCX_RW (IMG_pcx.c).

Fixing these issues:

Patches are quite straightforward and I believe that some of these
issues are worth fixing (reporter claims that they are "exploitable").

I have prepared and uploaded a jessie LTS update addressing most of these
issues (all of them apart from CVE-2019-5051) via targeted fixes.

If the security team agrees, I will provide targeted fixes for buster and
stretch.

For testing, I suggest to package the latest upstream release. If needed, I
can provide an update with targeted fixes.

regards,
Hugo

[0] https://security-tracker.debian.org/tracker/source-package/libsdl2-image

-- 
                Hugo Lefeuvre (hle)    |    www.owl.eu.com
RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD
ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 932754@bugs.debian.org (full text, mbox, reply):

From: Hugo Lefeuvre <hle@debian.org>

To: Felix Geyer <fgeyer@debian.org>

Cc: debian-lts@lists.debian.org, "Manuel A. Fernandez Montecelo" <mafm@debian.org>, 932754@bugs.debian.org

Subject: Re: libsdl2-image security issues in testing

Date: Mon, 22 Jul 2019 18:49:15 -0300

[Message part 1 (text/plain, inline)]

Hi Felix,

(CC-ing #932754 which tracks this issue)

> > I have prepared a jessie (LTS) update addressing libsdl2-image's current
> > security issues. I will coordinate with the security team to possibly fix
> > them in a future stretch/buster point update.
> > 
> > Are you planning to address these issues in testing?  Packaging upstream's
> > latest 2.0.5 release should be sufficient, but they can also be addressed
> > with more targeted fixes.
> > 
> > I can provide some help if needed.
> 
> Thanks for your work!
>
> I'm preparing a 2.0.5 upload right now.

Great, thanks!

> As far as I can tell all CVEs in the tracker are fixed with 2.0.5.
> Do you agree?

Exactly.

By the way, I had a second look and it appears that CVE-2019-5051 was also
fixed by the jessie LTS upload. CVE-2019-5051 is also a member of the
CVE-2019-12221 family, and is therefore fixed by [0].

cheers,
Hugo

[0] https://hg.libsdl.org/SDL_image/rev/e7e9786a1a34

-- 
                Hugo Lefeuvre (hle)    |    www.owl.eu.com
RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD
ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.