CVE catalog

CVE-2018-3977

libsdl2-image: CVE-2018-3977

[CVE catalog]

Severity
High · CVSS 7.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
3.48% · Oct 25, 2026

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.3. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansdl-image1.2sid1.2.12-14fixed
Debiansdl-image1.2forky1.2.12-14fixed
Debiansdl-image1.2trixie1.2.12-14fixed
Debiansdl-image1.2bookworm1.2.12-13fixed
Debianlibsdl2-imagesid2.8.12+dfsg-2fixed
Debianlibsdl2-imageforky2.8.12+dfsg-2fixed
Debianlibsdl2-imagetrixie2.8.8+dfsg-1+deb13u1fixed
Debianlibsdl2-imagebookworm2.6.3+dfsg-1fixed
Ubuntusdl-image1.216.041.2.12-5build2vulnerable
Ubuntusdl-image1.216.041.2.12-5+deb9u1build0.16.04.1vulnerable
Ubuntusdl-image1.216.041.2.12-5+deb9u1ubuntu0.16.04.1fixed
Ubuntusdl-image1.218.041.2.12-6vulnerable
Ubuntusdl-image1.218.041.2.12-7vulnerable
Ubuntusdl-image1.218.041.2.12-8vulnerable
Ubuntusdl-image1.218.041.2.12-8ubuntu0.1fixed
Ubuntulibsdl2-imagepro2.0.0+dfsg-2vulnerable
Ubuntulibsdl2-imagepro2.0.0+dfsg-3vulnerable
Ubuntulibsdl2-imagepro2.0.0+dfsg-3build2vulnerable
Ubuntulibsdl2-imagepro2.0.0+dfsg-3+deb8u1build0.14.04.1vulnerable
Ubuntulibsdl2-imagepro2.0.0+dfsg-3+deb8u2build0.14.04.1~esm1fixed
Ubuntusdl-image1.2pro1.2.12-4ubuntu1vulnerable
Ubuntusdl-image1.2pro1.2.12-5vulnerable
Ubuntusdl-image1.2pro1.2.12-5build2vulnerable
Ubuntusdl-image1.2pro1.2.12-5+deb9u1build0.14.04.1vulnerable
Ubuntusdl-image1.2pro1.2.12-5+deb9u1ubuntu0.14.04.1~esm1fixed
Ubuntusdl-image1.216.041.2.12-5build2vulnerable
Ubuntusdl-image1.216.041.2.12-5+deb9u1build0.16.04.1vulnerable
Ubuntusdl-image1.216.041.2.12-5+deb9u1ubuntu0.16.04.1fixed
Ubuntusdl-image1.218.041.2.12-6vulnerable
Ubuntusdl-image1.218.041.2.12-7vulnerable
Ubuntusdl-image1.218.041.2.12-8vulnerable
Ubuntusdl-image1.218.041.2.12-8ubuntu0.1fixed
SuseSDL_imagelinux enterprise software development kit 11 sp41.2.6-84.46.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansdl-image1.2sourcesid1.2.12-10not yet assignedNot reported[912618]
Debiansdl-image1.2sourceforky1.2.12-10not yet assignedNot reported[912618]
Debiansdl-image1.2sourcetrixie1.2.12-10not yet assignedNot reported[912618]
Debiansdl-image1.2sourcebookworm1.2.12-10not yet assignedNot reported[912618]
Debianlibsdl2-imagesourcesid2.0.3+dfsg1-3not yet assignedNot reported[912617]
Debianlibsdl2-imagesourceforky2.0.3+dfsg1-3not yet assignedNot reported[912617]
Debianlibsdl2-imagesourcetrixie2.0.3+dfsg1-3not yet assignedNot reported[912617]
Debianlibsdl2-imagesourcebookworm2.0.3+dfsg1-3not yet assignedNot reported[912617]
Ubuntusdl-image1.2deb16.041.2.12-5+deb9u1ubuntu0.16.04.1Not reportedUSN-4238-1Not reported
Ubuntusdl-image1.2deb18.041.2.12-8ubuntu0.1Not reportedUSN-4238-1Not reported
Ubuntulibsdl2-imagedebpro2.0.0+dfsg-3+deb8u2build0.14.04.1~esm1Not reportedUBUNTU-CVE-2018-3977Not reported
Ubuntusdl-image1.2debpro1.2.12-5+deb9u1ubuntu0.14.04.1~esm1Not reportedUBUNTU-CVE-2018-3977Not reported
Ubuntusdl-image1.2deb16.041.2.12-5+deb9u1ubuntu0.16.04.1Not reportedUBUNTU-CVE-2018-3977Not reported
Ubuntusdl-image1.2deb18.041.2.12-8ubuntu0.1Not reportedUBUNTU-CVE-2018-3977Not reported
SuseSDL_imagerpmlinux enterprise software development kit 11 sp41.2.6-84.46.1Not reportedSUSE-SU-2018:3861-1Not reported

[Debian bug #912618][Debian bug #912617]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libsdl2-image-2.0-0]Fixed

    Source package: [libsdl2-image]

    Details (2)

    • 2.6.3+dfsg-1 · amd64 · bookworm

      Fixed · Fixed: 2.0.3+dfsg1-3

      dsa · libsdl2-image · debian · bookworm; dsa · libsdl2-image · debian · 12

    • 2.6.3+dfsg-1 · arm64 · bookworm

      Fixed · Fixed: 2.0.3+dfsg1-3

      dsa · libsdl2-image · debian · bookworm; dsa · libsdl2-image · debian · 12

  • [libsdl2-image-dev]Fixed

    Source package: [libsdl2-image]

    Details (2)

    • 2.6.3+dfsg-1 · amd64 · bookworm

      Fixed · Fixed: 2.0.3+dfsg1-3

      dsa · libsdl2-image · debian · bookworm; dsa · libsdl2-image · debian · 12

    • 2.6.3+dfsg-1 · arm64 · bookworm

      Fixed · Fixed: 2.0.3+dfsg1-3

      dsa · libsdl2-image · debian · bookworm; dsa · libsdl2-image · debian · 12

  • [libsdl2-image-tests]Fixed

    Source package: [libsdl2-image]

    Details (2)

    • 2.6.3+dfsg-1 · amd64 · bookworm

      Fixed · Fixed: 2.0.3+dfsg1-3

      dsa · libsdl2-image · debian · bookworm; dsa · libsdl2-image · debian · 12

    • 2.6.3+dfsg-1 · arm64 · bookworm

      Fixed · Fixed: 2.0.3+dfsg1-3

      dsa · libsdl2-image · debian · bookworm; dsa · libsdl2-image · debian · 12

  • [libsdl-image1.2]Fixed

    Source package: [sdl-image1.2]

    Details (2)

    • 1.2.12-13+b2 · amd64 · bookworm

      Fixed · Fixed: 1.2.12-10

      dsa · sdl-image1.2 · debian · bookworm; dsa · sdl-image1.2 · debian · 12

    • 1.2.12-13+b2 · arm64 · bookworm

      Fixed · Fixed: 1.2.12-10

      dsa · sdl-image1.2 · debian · bookworm; dsa · sdl-image1.2 · debian · 12

  • [libsdl-image1.2-dev]Fixed

    Source package: [sdl-image1.2]

    Details (2)

    • 1.2.12-13+b2 · amd64 · bookworm

      Fixed · Fixed: 1.2.12-10

      dsa · sdl-image1.2 · debian · bookworm; dsa · sdl-image1.2 · debian · 12

    • 1.2.12-13+b2 · arm64 · bookworm

      Fixed · Fixed: 1.2.12-10

      dsa · sdl-image1.2 · debian · bookworm; dsa · sdl-image1.2 · debian · 12

[Debian 13 (Trixie)]

  • [libsdl2-image-2.0-0]Fixed

    Source package: [libsdl2-image]

    Details (2)

    • 2.8.8+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 2.0.3+dfsg1-3

      dsa · libsdl2-image · debian · 13

    • 2.8.8+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 2.0.3+dfsg1-3

      dsa · libsdl2-image · debian · 13

  • [libsdl2-image-dev]Fixed

    Source package: [libsdl2-image]

    Details (2)

    • 2.8.8+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 2.0.3+dfsg1-3

      dsa · libsdl2-image · debian · 13

    • 2.8.8+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 2.0.3+dfsg1-3

      dsa · libsdl2-image · debian · 13

  • [libsdl2-image-tests]Fixed

    Source package: [libsdl2-image]

    Details (2)

    • 2.8.8+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 2.0.3+dfsg1-3

      dsa · libsdl2-image · debian · 13

    • 2.8.8+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 2.0.3+dfsg1-3

      dsa · libsdl2-image · debian · 13

  • [libsdl-image1.2]Fixed

    Source package: [sdl-image1.2]

    Details (2)

    • 1.2.12-14 · amd64 · trixie

      Fixed · Fixed: 1.2.12-10

      dsa · sdl-image1.2 · debian · 13

    • 1.2.12-14 · arm64 · trixie

      Fixed · Fixed: 1.2.12-10

      dsa · sdl-image1.2 · debian · 13

  • [libsdl-image1.2-dev]Fixed

    Source package: [sdl-image1.2]

    Details (2)

    • 1.2.12-14 · amd64 · trixie

      Fixed · Fixed: 1.2.12-10

      dsa · sdl-image1.2 · debian · 13

    • 1.2.12-14 · arm64 · trixie

      Fixed · Fixed: 1.2.12-10

      dsa · sdl-image1.2 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]