CVE-2019-7576
Fixed in a distro release EPSS 3%
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop).
Products: libsdl simple_directmedia_layer, debian_linux, opensuse leap, fedoraproject fedora, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | sdl | 1.2.15-r11 |
| Alpine 3.10 | sdl2 | 2.0.10-r0 |
| Alpine 3.11 | sdl | 1.2.15-r11 |
| Alpine 3.11 | sdl2 | 2.0.10-r0 |
| Alpine 3.12 | sdl | 1.2.15-r11 |
| Alpine 3.7 | sdl | 1.2.15-r8 |
| Alpine 3.7 | sdl2 | 2.0.10-r0 |
| Alpine 3.8 | sdl | 1.2.15-r9 |
| Alpine 3.8 | sdl2 | 2.0.10-r0 |
| Alpine 3.9 | sdl | 1.2.15-r10 |
| Alpine 3.9 | sdl2 | 2.0.10-r0 |
| Amazon Linux 2 | SDL | 1.2.15-17.amzn2 |
| Amazon Linux 2 | SDL-devel | 1.2.15-17.amzn2 |
| Amazon Linux 2 | SDL-static | 1.2.15-17.amzn2 |
| Debian 10 | libsdl2 | 2.0.9+dfsg1-1+deb10u1 |
| Debian 12 | libsdl1.2 | 1.2.15+dfsg2-5 |
| Debian 12 | libsdl2 | 2.0.10+dfsg1-1 |
| Debian 13 | libsdl2 | 2.0.10+dfsg1-1 |
| Debian 14 | libsdl2 | 2.0.10+dfsg1-1 |
| Debian 8 | libsdl1.2 | 1.2.15-10+deb8u1 |
| Debian 8 | libsdl2 | 2.0.2+dfsg1-6+deb8u1 |
| Debian 9 | libsdl1.2 | 1.2.15+dfsg1-4+deb9u1 |
| Red Hat Enterprise Linux 7 | SDL | 0:1.2.15-17.el7 |
| Red Hat Enterprise Linux 7 | SDL-debuginfo | 0:1.2.15-17.el7 |
| Red Hat Enterprise Linux 7 | SDL-devel | 0:1.2.15-17.el7 |
| Red Hat Enterprise Linux 7 | SDL-static | 0:1.2.15-17.el7 |
| Red Hat Enterprise Linux 8 | SDL | 0:1.2.15-38.el8 |
| Red Hat Enterprise Linux 8 | SDL-debuginfo | 0:1.2.15-38.el8 |
| Red Hat Enterprise Linux 8 | SDL-debugsource | 0:1.2.15-38.el8 |
| Red Hat Enterprise Linux 8 | SDL-devel | 0:1.2.15-38.el8 |
| SUSE Linux Enterprise Desktop 12 SP3 | SDL | 1.2.15-15.11.1 |
| SUSE Linux Enterprise Desktop 12 SP4 | SDL | 1.2.15-15.11.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 | SDL | 1.2.15-3.9.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 | SDL2 | 2.0.8-3.9.1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | SDL | 1.2.13-106.11.1 |
| SUSE Linux Enterprise Server 11 SP4 | SDL | 1.2.13-106.11.1 |
| SUSE Linux Enterprise Server 12 SP3 | SDL | 1.2.15-15.11.1 |
| SUSE Linux Enterprise Server 12 SP4 | SDL | 1.2.15-15.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | SDL | 1.2.13-106.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | SDL | 1.2.15-15.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | SDL | 1.2.15-15.11.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | SDL | 1.2.13-106.11.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | SDL | 1.2.15-15.11.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | SDL | 1.2.15-15.11.1 |
| Ubuntu 16.04 LTS | libsdl1.2 | 1.2.15+dfsg1-3ubuntu0.1 |
| Ubuntu 16.04 LTS | libsdl2 | no fix |
| Ubuntu 18.04 LTS | libsdl1.2 | 1.2.15+dfsg2-0.1ubuntu0.1 |
| Ubuntu Pro 14.04 LTS | libsdl1.2 | 1.2.15-8ubuntu1.1+esm1 |
| Ubuntu Pro 14.04 LTS | libsdl2 | 2.0.2+dfsg1-3ubuntu1.3+esm1 |
| Ubuntu Pro 18.04 LTS | libsdl2 | no fix |
| openSUSE Leap 15.0 | SDL | 1.2.15-lp150.2.3.1 |
| openSUSE Leap 15.0 | SDL2 | 2.0.8-lp150.2.3.1 |