CVE-2018-3838

An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds read on the heap, resulting in information disclosure. An attacker can display a specially crafted image to trigger this vulnerability.

Score

CVSS 3.1 6.5 Medium

Status

Modified - talos-cna@cisco.com

Published

2018-04-10

Last modified

2024-09-16

Weaknesses

CWE-125

Affected products

• Simple Directmedia (Cisco Systems Inc.)
• Debian Linux (Debian)
• Sdl Image (Libsdl)

References

• https://security.gentoo.org/glsa/201903-17
• https://www.debian.org/security/2018/dsa-4177
• https://www.debian.org/security/2018/dsa-4184
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0520