openSUSE Security Update: Security update for SDL2, SDL2_image
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:0734-1
Rating: important
References: #1025413 #1084256 #1084257 #1084282 #1084288
#1084297 #1084303 #1084304
Cross-References: CVE-2017-12122 CVE-2017-14440 CVE-2017-14441
CVE-2017-14442 CVE-2017-14448 CVE-2017-14449
CVE-2017-14450
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that solves 7 vulnerabilities and has one errata
is now available.

Description:

This update for SDL2 and SDL2_image fixes the following issues:

– CVE-2017-14441: Code execution in the ICO image rendering (bsc#1084282).
– CVE-2017-14440: Potential code execution in the ILBM image rendering
functionality (bsc#1084257).
– CVE-2017-12122: Potential code execution in the ILBM image rendering
fuctionality (bsc#1084256).
– CVE-2017-14448: Heap buffer overflow in the XCF image rendering
functionality (bsc#1084303).
– CVE-2017-14449: Double-Free in the XCF image rendering (bsc#1084297).
– CVE-2017-14442: Stack buffer overflow the BMP image rendering
functionality (bsc#1084304).
– CVE-2017-14450: Buffer overflow in the GIF image parsing (bsc#1084288).

Bug fixes:

– boo#1025413: Add dbus-ime.diff and build with fcitx.

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-280=1

To bring your system up-to-date, use “zypper patch”.

Package List:

– openSUSE Leap 42.3 (i586 x86_64):

SDL2-debugsource-2.0.8-18.1
SDL2_image-debugsource-2.0.3-13.10.1
libSDL2-2_0-0-2.0.8-18.1
libSDL2-2_0-0-debuginfo-2.0.8-18.1
libSDL2-devel-2.0.8-18.1
libSDL2_image-2_0-0-2.0.3-13.10.1
libSDL2_image-2_0-0-debuginfo-2.0.3-13.10.1
libSDL2_image-devel-2.0.3-13.10.1

– openSUSE Leap 42.3 (x86_64):

libSDL2-2_0-0-32bit-2.0.8-18.1
libSDL2-2_0-0-debuginfo-32bit-2.0.8-18.1
libSDL2-devel-32bit-2.0.8-18.1
libSDL2_image-2_0-0-32bit-2.0.3-13.10.1
libSDL2_image-2_0-0-debuginfo-32bit-2.0.3-13.10.1
libSDL2_image-devel-32bit-2.0.3-13.10.1

References:

https://www.suse.com/security/cve/CVE-2017-12122.html
https://www.suse.com/security/cve/CVE-2017-14440.html
https://www.suse.com/security/cve/CVE-2017-14441.html
https://www.suse.com/security/cve/CVE-2017-14442.html
https://www.suse.com/security/cve/CVE-2017-14448.html
https://www.suse.com/security/cve/CVE-2017-14449.html
https://www.suse.com/security/cve/CVE-2017-14450.html
https://bugzilla.suse.com/1025413
https://bugzilla.suse.com/1084256
https://bugzilla.suse.com/1084257
https://bugzilla.suse.com/1084282
https://bugzilla.suse.com/1084288
https://bugzilla.suse.com/1084297
https://bugzilla.suse.com/1084303
https://bugzilla.suse.com/1084304

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org