Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.2818
sdl-image1.2 security update
29 July 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: sdl-image
Publisher: Debian
Operating System: Debian GNU/Linux 8
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2019-12222 CVE-2019-12221 CVE-2019-12220
CVE-2019-12219 CVE-2019-12218 CVE-2019-12217
CVE-2019-12216 CVE-2019-7635 CVE-2019-5052
CVE-2019-5051 CVE-2018-3977
Reference: ESB-2019.2738
ESB-2019.2471
ESB-2019.1296
ESB-2018.3642
Original Bulletin:
https://security-tracker.debian.org/tracker/DLA-1865-1
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Package : sdl-image1.2
Version : 1.2.12-5+deb9u2
CVE ID : CVE-2018-3977 CVE-2019-5051 CVE-2019-5052 CVE-2019-7635
CVE-2019-12216 CVE-2019-12217 CVE-2019-12218 CVE-2019-12219
CVE-2019-12220 CVE-2019-12221 CVE-2019-12222
The following issues have been found in sdl-image1.2, the 1.x version of the
image file loading library.
CVE-2018-3977
Heap buffer overflow in IMG_xcf.c. This vulnerability might be leveraged by
remote attackers to cause remote code execution or denial of service via a
crafted XCF file.
CVE-2019-5051
Heap based buffer overflow in IMG_LoadPCX_RW, in IMG_pcx.c. This
vulnerability might be leveraged by remote attackers to cause remote code
execution or denial of service via a crafted PCX file.
CVE-2019-5052
Integer overflow and subsequent buffer overflow in IMG_pcx.c. This
vulnerability might be leveraged by remote attackers to cause remote code
execution or denial of service via a crafted PCX file.
CVE-2019-7635
Heap buffer overflow affecting Blit1to4, in IMG_bmp.c. This vulnerability
might be leveraged by remote attackers to cause denial of service or any
other unspecified impact via a crafted BMP file.
CVE-2019-12216,
CVE-2019-12217,
CVE-2019-12218,
CVE-2019-12219,
CVE-2019-12220,
CVE-2019-12221,
CVE-2019-12222
Multiple out-of-bound read and write accesses affecting IMG_LoadPCX_RW, in
IMG_pcx.c. These vulnerabilities might be leveraged by remote attackers to
cause denial of service or any other unspecified impact via a crafted PCX
file.
For Debian 8 "Jessie", these problems have been fixed in version
1.2.12-5+deb9u2.
We recommend that you upgrade your sdl-image1.2 packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQGzBAEBCgAdFiEEeDb9QWtkMa2LX4zREeMFjl5EGkIFAl08l+8ACgkQEeMFjl5E
GkJ5NQv9FHq278lYV1Rc7SQttux4aR52YZ2X+IznqAAU8JTOqpEZIHgTrCsfye+S
Mua8DCytszb2llH9Q9Fqa9PLcqxPIjXq3Nj/ycYgXewUO9xfoQhYHaka8Wfy1bgH
KNRvx+R76h3d841l8Pi48jKYPQ8RXbiW6OO7Qs9l+QEgKozZfJ9Gk0khkyGT06Gr
KeRLXHMq3mp/9ET6kgUcQFjddNXv+cEky7+73JdgaikVXRX8w/n41clHU87FJAz8
5lFRVUTVnyUdS+XqCWEsjOLRsQ2ss6bCDVwP+TtKC7cuLdpz6QKpqfd1cJvrcpO7
lnnNaBVFZeQ3RS63DVCwNLH+uww9YDuAv+I7kRwZ/MqYUdng2CBwn/01khieD8Ri
hZR0lds4Ci6ofElxxK75a4m2f6Tm3wpvh+TwpmvMioU9gPr7gJXKJvkDguzSEobK
w4Vt7iLfd1vLKLbNWJ/oAjI4sWRyXnYlJBcE1Pz4G9Iu/kK3m59mDYto0dUvtSRG
i+aAtgpz
=PwFl
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXT5A6GaOgq3Tt24GAQioOxAA0OfvjSUtlda+uSoZoVqOIrUXBuAqgUqE
Gr0f4QyDIr4H8KBsEHQtJFa2gZ9R9p3B1c+JlEtvFy2M2jeBsoUmytdbBJu3gIEe
jnrZRGmmKWb3XTcAEfHYCc68AQTlURvc3iToEGtzA01i29d+3JO3+0A0wpyh3VIz
E6jsllgrTAAGE/Teuu4GzwbMgqIOJDTWI3mOVa3vH4yNDpkYDvGIFpxiviUlflyR
N/1XoPk2zDh0+Ecek3AlQkhsjR75j6Q3FRdkPBGtaUSds5rcwTFVb8pt5/g5QYYh
Dsf+VB2dL+RU32q+g015hbOGn9J8kFkTzqkP31sFewrl33sCCP3zTUNZXBPBXIxv
pgOC3u8i8+ArSvqwJ/OVFd4TXrEny2bsVGEQgBZA3T7uhiPUOQq7x30hGYp12yff
uiB5dVT0g10H3MvwUnPXQ9ktjyibxYqFbbkleVE3IFWtCVghXcg3FY/MAb9C0ThA
py0mYO4t2aqftM4JSnAcMPB/qU5JnDaaMWL/Q8nYRdN1j+Uu6pXEp9kdVUYhpiJZ
Uh/rzz3TrMukukzbLWTsmKZjJy8V7Kds8xlBhOQEYDWtaPmuaItcnLl//VP8a0rw
Fzu+LooPdaa8xerc2Kh2+V92llFsGvYUVZ6Ae9z02CnGTqJEmj5L1t0WUpS2bOLf
BzruU0DrplA=
=ktGN
-----END PGP SIGNATURE-----