CVE catalog

CVE-2019-12220

libsdl2-image: CVE-2019-12220

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.87% · Oct 25, 2026

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an out-of-bounds read in the SDL function SDL_FreePalette_REAL at video/SDL_pixels.c.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansdl-image1.2sid1.2.12-14fixed
Debiansdl-image1.2forky1.2.12-14fixed
Debiansdl-image1.2trixie1.2.12-14fixed
Debiansdl-image1.2bookworm1.2.12-13fixed
Debianlibsdl2-imagesid2.8.12+dfsg-2fixed
Debianlibsdl2-imageforky2.8.12+dfsg-2fixed
Debianlibsdl2-imagetrixie2.8.8+dfsg-1+deb13u1fixed
Debianlibsdl2-imagebookworm2.6.3+dfsg-1fixed
Ubuntulibsdl2-imagepro2.0.0+dfsg-2vulnerable
Ubuntulibsdl2-imagepro2.0.0+dfsg-3vulnerable
Ubuntulibsdl2-imagepro2.0.0+dfsg-3build2vulnerable
Ubuntulibsdl2-imagepro2.0.0+dfsg-3+deb8u1build0.14.04.1vulnerable
Ubuntulibsdl2-imagepro2.0.0+dfsg-3+deb8u2build0.14.04.1~esm1fixed
Ubuntusdl-image1.2pro1.2.12-4ubuntu1vulnerable
Ubuntusdl-image1.2pro1.2.12-5vulnerable
Ubuntusdl-image1.2pro1.2.12-5build2vulnerable
Ubuntusdl-image1.2pro1.2.12-5+deb9u1build0.14.04.1vulnerable
Ubuntusdl-image1.2pro1.2.12-5+deb9u1ubuntu0.14.04.1~esm1fixed
Ubuntusdl-image1.216.041.2.12-5build2vulnerable
Ubuntusdl-image1.216.041.2.12-5+deb9u1build0.16.04.1vulnerable
Ubuntusdl-image1.216.041.2.12-5+deb9u1ubuntu0.16.04.1fixed
Ubuntulibsdl2-image16.042.0.0+dfsg-3build2vulnerable
Ubuntulibsdl2-image16.042.0.1+dfsg-1vulnerable
Ubuntulibsdl2-image16.042.0.1+dfsg-2vulnerable
Ubuntulibsdl2-image16.042.0.1+dfsg-2+deb9u1build0.16.04.1vulnerable
Ubuntusdl-image1.218.041.2.12-6vulnerable
Ubuntusdl-image1.218.041.2.12-7vulnerable
Ubuntusdl-image1.218.041.2.12-8vulnerable
Ubuntusdl-image1.218.041.2.12-8ubuntu0.1fixed
Ubuntulibsdl2-image18.042.0.1+dfsg-3vulnerable
Ubuntulibsdl2-image18.042.0.1+dfsg-4vulnerable
Ubuntulibsdl2-image18.042.0.2+dfsg1-1vulnerable
Ubuntulibsdl2-image18.042.0.3+dfsg1-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansdl-image1.2sourcesid1.2.12-11not yet assignedNot reported[932755]
Debiansdl-image1.2sourceforky1.2.12-11not yet assignedNot reported[932755]
Debiansdl-image1.2sourcetrixie1.2.12-11not yet assignedNot reported[932755]
Debiansdl-image1.2sourcebookworm1.2.12-11not yet assignedNot reported[932755]
Debianlibsdl2-imagesourcesid2.0.5+dfsg1-1not yet assignedNot reported[932754]
Debianlibsdl2-imagesourceforky2.0.5+dfsg1-1not yet assignedNot reported[932754]
Debianlibsdl2-imagesourcetrixie2.0.5+dfsg1-1not yet assignedNot reported[932754]
Debianlibsdl2-imagesourcebookworm2.0.5+dfsg1-1not yet assignedNot reported[932754]
Ubuntulibsdl2-imagedebpro2.0.0+dfsg-3+deb8u2build0.14.04.1~esm1Not reportedUBUNTU-CVE-2019-12220Not reported
Ubuntusdl-image1.2debpro1.2.12-5+deb9u1ubuntu0.14.04.1~esm1Not reportedUBUNTU-CVE-2019-12220Not reported
Ubuntusdl-image1.2deb16.041.2.12-5+deb9u1ubuntu0.16.04.1Not reportedUBUNTU-CVE-2019-12220Not reported
Ubuntusdl-image1.2deb18.041.2.12-8ubuntu0.1Not reportedUBUNTU-CVE-2019-12220Not reported

[Debian bug #932755][Debian bug #932754]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libsdl2-image-2.0-0]Fixed

    Source package: [libsdl2-image]

    Details (2)

    • 2.6.3+dfsg-1 · amd64 · bookworm

      Fixed · Fixed: 2.0.5+dfsg1-1

      dsa · libsdl2-image · debian · bookworm; dsa · libsdl2-image · debian · 12

    • 2.6.3+dfsg-1 · arm64 · bookworm

      Fixed · Fixed: 2.0.5+dfsg1-1

      dsa · libsdl2-image · debian · bookworm; dsa · libsdl2-image · debian · 12

  • [libsdl2-image-dev]Fixed

    Source package: [libsdl2-image]

    Details (2)

    • 2.6.3+dfsg-1 · amd64 · bookworm

      Fixed · Fixed: 2.0.5+dfsg1-1

      dsa · libsdl2-image · debian · bookworm; dsa · libsdl2-image · debian · 12

    • 2.6.3+dfsg-1 · arm64 · bookworm

      Fixed · Fixed: 2.0.5+dfsg1-1

      dsa · libsdl2-image · debian · bookworm; dsa · libsdl2-image · debian · 12

  • [libsdl2-image-tests]Fixed

    Source package: [libsdl2-image]

    Details (2)

    • 2.6.3+dfsg-1 · amd64 · bookworm

      Fixed · Fixed: 2.0.5+dfsg1-1

      dsa · libsdl2-image · debian · bookworm; dsa · libsdl2-image · debian · 12

    • 2.6.3+dfsg-1 · arm64 · bookworm

      Fixed · Fixed: 2.0.5+dfsg1-1

      dsa · libsdl2-image · debian · bookworm; dsa · libsdl2-image · debian · 12

  • [libsdl-image1.2]Fixed

    Source package: [sdl-image1.2]

    Details (2)

    • 1.2.12-13+b2 · amd64 · bookworm

      Fixed · Fixed: 1.2.12-11

      dsa · sdl-image1.2 · debian · bookworm; dsa · sdl-image1.2 · debian · 12

    • 1.2.12-13+b2 · arm64 · bookworm

      Fixed · Fixed: 1.2.12-11

      dsa · sdl-image1.2 · debian · bookworm; dsa · sdl-image1.2 · debian · 12

  • [libsdl-image1.2-dev]Fixed

    Source package: [sdl-image1.2]

    Details (2)

    • 1.2.12-13+b2 · amd64 · bookworm

      Fixed · Fixed: 1.2.12-11

      dsa · sdl-image1.2 · debian · bookworm; dsa · sdl-image1.2 · debian · 12

    • 1.2.12-13+b2 · arm64 · bookworm

      Fixed · Fixed: 1.2.12-11

      dsa · sdl-image1.2 · debian · bookworm; dsa · sdl-image1.2 · debian · 12

[Debian 13 (Trixie)]

  • [libsdl2-image-2.0-0]Fixed

    Source package: [libsdl2-image]

    Details (2)

    • 2.8.8+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 2.0.5+dfsg1-1

      dsa · libsdl2-image · debian · 13

    • 2.8.8+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 2.0.5+dfsg1-1

      dsa · libsdl2-image · debian · 13

  • [libsdl2-image-dev]Fixed

    Source package: [libsdl2-image]

    Details (2)

    • 2.8.8+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 2.0.5+dfsg1-1

      dsa · libsdl2-image · debian · 13

    • 2.8.8+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 2.0.5+dfsg1-1

      dsa · libsdl2-image · debian · 13

  • [libsdl2-image-tests]Fixed

    Source package: [libsdl2-image]

    Details (2)

    • 2.8.8+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 2.0.5+dfsg1-1

      dsa · libsdl2-image · debian · 13

    • 2.8.8+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 2.0.5+dfsg1-1

      dsa · libsdl2-image · debian · 13

  • [libsdl-image1.2]Fixed

    Source package: [sdl-image1.2]

    Details (2)

    • 1.2.12-14 · amd64 · trixie

      Fixed · Fixed: 1.2.12-11

      dsa · sdl-image1.2 · debian · 13

    • 1.2.12-14 · arm64 · trixie

      Fixed · Fixed: 1.2.12-11

      dsa · sdl-image1.2 · debian · 13

  • [libsdl-image1.2-dev]Fixed

    Source package: [sdl-image1.2]

    Details (2)

    • 1.2.12-14 · amd64 · trixie

      Fixed · Fixed: 1.2.12-11

      dsa · sdl-image1.2 · debian · 13

    • 1.2.12-14 · arm64 · trixie

      Fixed · Fixed: 1.2.12-11

      dsa · sdl-image1.2 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]