==========================================================================
Ubuntu Security Notice USN-4143-1
September 30, 2019

SDL 2.0 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 19.04
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

SDL 2.0 could be made to crash or run programs as your login if it
opened a specially crafted file.

Software Description:
– libsdl2: Simple DirectMedia Layer: cross-platform development library
providing access to low level media interfaces

Details:

It was discovered that SDL 2.0 mishandled crafted image files resulting in an
integer overflow. If a user were tricked into opening a malicious file, SDL
2.0 could be caused to crash or potentially run arbitrary code.
(CVE-2017-2888)

It was discovered that SDL 2.0 mishandled crafted image files. If a user were
tricked into opening a malicious file, SDL 2.0 could be caused to crash or
potentially run arbitrary code.
(CVE-2019-7635, CVE-2019-7636, CVE-2019-7637, CVE-2019-7638)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
libsdl2-2.0-0 2.0.9+dfsg1-1ubuntu1.19.04.1

Ubuntu 18.04 LTS:
libsdl2-2.0-0 2.0.8+dfsg1-1ubuntu1.18.04.4

Ubuntu 16.04 LTS:
libsdl2-2.0-0 2.0.4+dfsg1-2ubuntu2.16.04.2

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4143-1
CVE-2017-2888, CVE-2019-7635, CVE-2019-7636, CVE-2019-7637,
CVE-2019-7638

Package Information:
https://launchpad.net/ubuntu/+source/libsdl2/2.0.9+dfsg1-1ubuntu1.19.04.1
https://launchpad.net/ubuntu/+source/libsdl2/2.0.8+dfsg1-1ubuntu1.18.04.4
https://launchpad.net/ubuntu/+source/libsdl2/2.0.4+dfsg1-2ubuntu2.16.04.2

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEwZbe96kJeWh2OITRdyg1Qz0oXX0FAl2SHMMACgkQdyg1Qz0o
XX2n/w//TP5U/a7nJXH8UIzIS9v9yuMynktmCJf/UT6Ua0qpBa7M2cq3W3iVSedz
9RgvQ7pycP8761TiBRb8dtRJ4AQiyvdG3x40VTQCfMZzexXylz+wz8YI7p9bfZ3z
Urnl3rqFWCMDd5lrft3oqhJsrHqyHpQ2kXFPJVhSrbjex4RXqptVkZ3HtL1/7rF8
ZhUdd3LjZXlI6WzLI2FBX/xLxtgVg+7KkuBKjENcgPOlCUk9pFYD7hdWAhPxZGAg
9gAJpOCg7aIT73ZUVp9TmFjFNDq//FN3LgmZMzmG7Vlo1c2+r8fH0RdcXRPn3ZLe
7oxeGFH9YSMrByditKMvgdFbLJ3rNbYujiZwFyACQKpTUBTZ2UBWwL1WymAn2RBa
Api+XgpO7n9w4VxL/pIhshAP8bjPIskZMA6yAX0TsWjZMapi1dRedyZfbWQGTFX6
wEhrNK1p2FJxzMST8c5A/PI0ZCf2pbz2jqHuvKcjFXxIBiaE8det6Gr4Ojl8G7kY
l8wR9r/elp4g/9DditI8c0ot0C331jooBL7ElLO4J1vZFTS0MlIjkwIENL0sk3uw
jcRXLghFnyM7WZIm0yUqwbbFL7ST4RSs9bWQpZtoejzm5Q16Db3LX+QBsZ313uFh
xh7ddDfdH7fN2AV8Md9NDalJ9X03JApu7NtS3UCOGmySyuDA1Vk=
=hg//
—–END PGP SIGNATURE—–
—