CVE catalog

CVE-2020-14409

libsdl2: CVE-2020-14409

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.32% · Oct 25, 2026

SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SDL_blit_copy.c via a crafted .BMP file.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibsdl2sid2.32.10+dfsg-8fixed
Debianlibsdl2forky2.32.10+dfsg-8fixed
Debianlibsdl2trixie2.32.4+dfsg-1fixed
Debianlibsdl2bookworm2.26.5+dfsg-1fixed
Ubuntulibsdl2pro2.0.10+dfsg1-1ubuntu1vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-1ubuntu4vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-1ubuntu6vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-1ubuntu7vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-1ubuntu8vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-2ubuntu5vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-3vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-3ubuntu0.1~esm1fixed
Ubuntulibsdl2pro2.0.10+dfsg1-1ubuntu1vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-1ubuntu4vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-1ubuntu6vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-1ubuntu7vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-1ubuntu8vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-2ubuntu5vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-3vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-3ubuntu0.1~esm1fixed
SuseSDLhpe helion openstack 81.2.15-15.17.1fixed
SuseSDLopenstack cloud 81.2.15-15.17.1fixed
SuseSDLopenstack cloud 91.2.15-15.17.1fixed
SuseSDLopenstack cloud crowbar 81.2.15-15.17.1fixed
SuseSDLopenstack cloud crowbar 91.2.15-15.17.1fixed
SuseSDLlinux enterprise server for sap applications 12 sp31.2.15-15.17.1fixed
SuseSDLlinux enterprise server for sap applications 12 sp41.2.15-15.17.1fixed
SuseSDLlinux enterprise software development kit 12 sp51.2.15-15.17.1fixed
SuseSDLlinux enterprise server 12 sp2-bcl1.2.15-15.17.1fixed
SuseSDLlinux enterprise server 12 sp3-ltss1.2.15-15.17.1fixed
SuseSDLlinux enterprise server 12 sp3-bcl1.2.15-15.17.1fixed
SuseSDLlinux enterprise server 12 sp4-ltss1.2.15-15.17.1fixed
SuseSDLlinux enterprise server 12 sp51.2.15-15.17.1fixed
SuseSDLlinux enterprise server for sap applications 12 sp51.2.15-15.17.1fixed
SuseSDL2linux enterprise real time 15 sp22.0.8-11.3.1fixed
SuseSDL2linux enterprise module for desktop applications 15 sp32.0.8-11.3.1fixed
SuseSDL2linux enterprise module for package hub 15 sp32.0.8-11.3.1fixed
SuseSDL2linux enterprise high performance computing 15 sp2-espos2.0.8-11.3.1fixed
SuseSDL2linux enterprise high performance computing 15 sp2-ltss2.0.8-11.3.1fixed
SuseSDL2linux enterprise server 15 sp2-bcl2.0.8-11.3.1fixed
SuseSDL2linux enterprise server 15 sp2-ltss2.0.8-11.3.1fixed
SuseSDL2linux enterprise server for sap applications 15 sp22.0.8-11.3.1fixed
SuseSDL2manager proxy 4.12.0.8-11.3.1fixed
SuseSDL2manager retail branch server 4.12.0.8-11.3.1fixed
SuseSDL2manager server 4.12.0.8-11.3.1fixed
SuseSDL2enterprise storage 72.0.8-11.3.1fixed
SuseSDL2linux enterprise high performance computing 15-espos2.0.8-3.18.1fixed
SuseSDL2linux enterprise high performance computing 15-ltss2.0.8-3.18.1fixed
SuseSDL2linux enterprise high performance computing 15 sp1-espos2.0.8-3.18.1fixed
SuseSDL2linux enterprise high performance computing 15 sp1-ltss2.0.8-3.18.1fixed
SuseSDL2linux enterprise server 15-ltss2.0.8-3.18.1fixed
SuseSDL2linux enterprise server 15 sp1-bcl2.0.8-3.18.1fixed
SuseSDL2linux enterprise server 15 sp1-ltss2.0.8-3.18.1fixed
SuseSDL2linux enterprise server for sap applications 152.0.8-3.18.1fixed
SuseSDL2linux enterprise server for sap applications 15 sp12.0.8-3.18.1fixed
SuseSDL2enterprise storage 62.0.8-3.18.1fixed
SuseSDLlinux enterprise module for desktop applications 15 sp31.2.15-150000.3.19.1fixed
SuseSDLlinux enterprise module for package hub 15 sp31.2.15-150000.3.19.1fixed
SuseSDLlinux enterprise high performance computing 15-espos1.2.15-150000.3.19.1fixed
SuseSDLlinux enterprise high performance computing 15-ltss1.2.15-150000.3.19.1fixed
SuseSDLlinux enterprise high performance computing 15 sp1-espos1.2.15-150000.3.19.1fixed
SuseSDLlinux enterprise high performance computing 15 sp1-ltss1.2.15-150000.3.19.1fixed
SuseSDLlinux enterprise high performance computing 15 sp2-espos1.2.15-150000.3.19.1fixed
SuseSDLlinux enterprise high performance computing 15 sp2-ltss1.2.15-150000.3.19.1fixed
SuseSDLlinux enterprise real time 15 sp21.2.15-150000.3.19.1fixed
SuseSDLlinux enterprise server 15-ltss1.2.15-150000.3.19.1fixed
SuseSDLlinux enterprise server 15 sp1-bcl1.2.15-150000.3.19.1fixed
SuseSDLlinux enterprise server 15 sp1-ltss1.2.15-150000.3.19.1fixed
SuseSDLlinux enterprise server 15 sp2-bcl1.2.15-150000.3.19.1fixed
SuseSDLlinux enterprise server 15 sp2-ltss1.2.15-150000.3.19.1fixed
SuseSDLlinux enterprise server for sap applications 151.2.15-150000.3.19.1fixed
SuseSDLlinux enterprise server for sap applications 15 sp11.2.15-150000.3.19.1fixed
SuseSDLlinux enterprise server for sap applications 15 sp21.2.15-150000.3.19.1fixed
SuseSDLmanager proxy 4.11.2.15-150000.3.19.1fixed
SuseSDLmanager retail branch server 4.11.2.15-150000.3.19.1fixed
SuseSDLmanager server 4.11.2.15-150000.3.19.1fixed
SuseSDLenterprise storage 61.2.15-150000.3.19.1fixed
SuseSDLenterprise storage 71.2.15-150000.3.19.1fixed
OpensuseSDLleap 15.31.2.15-150000.3.19.1fixed
Susepdnspackage hub 15 sp34.3.1-bp153.2.3.1fixed
Opensusepdnsleap 15.34.3.1-bp153.2.3.1fixed
OpensuseSDL2leap 15.32.0.8-11.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibsdl2sourcesid2.0.14+dfsg2-2not yet assignedNot reportedNot reported
Debianlibsdl2sourceforky2.0.14+dfsg2-2not yet assignedNot reportedNot reported
Debianlibsdl2sourcetrixie2.0.14+dfsg2-2not yet assignedNot reportedNot reported
Debianlibsdl2sourcebookworm2.0.14+dfsg2-2not yet assignedNot reportedNot reported
Ubuntulibsdl2debpro2.0.10+dfsg1-3ubuntu0.1~esm1Not reportedUSN-5274-1Not reported
Ubuntulibsdl2debpro2.0.10+dfsg1-3ubuntu0.1~esm1Not reportedUBUNTU-CVE-2020-14409Not reported
SuseSDLrpmhpe helion openstack 81.2.15-15.17.1Not reportedSUSE-SU-2022:1312-1Not reported
SuseSDLrpmopenstack cloud 81.2.15-15.17.1Not reportedSUSE-SU-2022:1312-1Not reported
SuseSDLrpmopenstack cloud 91.2.15-15.17.1Not reportedSUSE-SU-2022:1312-1Not reported
SuseSDLrpmopenstack cloud crowbar 81.2.15-15.17.1Not reportedSUSE-SU-2022:1312-1Not reported
SuseSDLrpmopenstack cloud crowbar 91.2.15-15.17.1Not reportedSUSE-SU-2022:1312-1Not reported
SuseSDLrpmlinux enterprise server for sap applications 12 sp31.2.15-15.17.1Not reportedSUSE-SU-2022:1312-1Not reported
SuseSDLrpmlinux enterprise server for sap applications 12 sp41.2.15-15.17.1Not reportedSUSE-SU-2022:1312-1Not reported
SuseSDLrpmlinux enterprise software development kit 12 sp51.2.15-15.17.1Not reportedSUSE-SU-2022:1312-1Not reported
SuseSDLrpmlinux enterprise server 12 sp2-bcl1.2.15-15.17.1Not reportedSUSE-SU-2022:1312-1Not reported
SuseSDLrpmlinux enterprise server 12 sp3-ltss1.2.15-15.17.1Not reportedSUSE-SU-2022:1312-1Not reported
SuseSDLrpmlinux enterprise server 12 sp3-bcl1.2.15-15.17.1Not reportedSUSE-SU-2022:1312-1Not reported
SuseSDLrpmlinux enterprise server 12 sp4-ltss1.2.15-15.17.1Not reportedSUSE-SU-2022:1312-1Not reported
SuseSDLrpmlinux enterprise server 12 sp51.2.15-15.17.1Not reportedSUSE-SU-2022:1312-1Not reported
SuseSDLrpmlinux enterprise server for sap applications 12 sp51.2.15-15.17.1Not reportedSUSE-SU-2022:1312-1Not reported
SuseSDL2rpmlinux enterprise real time 15 sp22.0.8-11.3.1Not reportedSUSE-SU-2022:0104-2Not reported
SuseSDL2rpmlinux enterprise module for desktop applications 15 sp32.0.8-11.3.1Not reportedSUSE-SU-2022:0104-1Not reported
SuseSDL2rpmlinux enterprise module for package hub 15 sp32.0.8-11.3.1Not reportedSUSE-SU-2022:0104-1Not reported
SuseSDL2rpmlinux enterprise high performance computing 15 sp2-espos2.0.8-11.3.1Not reportedSUSE-SU-2022:0104-1Not reported
SuseSDL2rpmlinux enterprise high performance computing 15 sp2-ltss2.0.8-11.3.1Not reportedSUSE-SU-2022:0104-1Not reported
SuseSDL2rpmlinux enterprise server 15 sp2-bcl2.0.8-11.3.1Not reportedSUSE-SU-2022:0104-1Not reported
SuseSDL2rpmlinux enterprise server 15 sp2-ltss2.0.8-11.3.1Not reportedSUSE-SU-2022:0104-1Not reported
SuseSDL2rpmlinux enterprise server for sap applications 15 sp22.0.8-11.3.1Not reportedSUSE-SU-2022:0104-1Not reported
SuseSDL2rpmmanager proxy 4.12.0.8-11.3.1Not reportedSUSE-SU-2022:0104-1Not reported
SuseSDL2rpmmanager retail branch server 4.12.0.8-11.3.1Not reportedSUSE-SU-2022:0104-1Not reported
SuseSDL2rpmmanager server 4.12.0.8-11.3.1Not reportedSUSE-SU-2022:0104-1Not reported
SuseSDL2rpmenterprise storage 72.0.8-11.3.1Not reportedSUSE-SU-2022:0104-1Not reported
SuseSDL2rpmlinux enterprise high performance computing 15-espos2.0.8-3.18.1Not reportedSUSE-SU-2022:0825-1Not reported
SuseSDL2rpmlinux enterprise high performance computing 15-ltss2.0.8-3.18.1Not reportedSUSE-SU-2022:0825-1Not reported
SuseSDL2rpmlinux enterprise high performance computing 15 sp1-espos2.0.8-3.18.1Not reportedSUSE-SU-2022:0825-1Not reported
SuseSDL2rpmlinux enterprise high performance computing 15 sp1-ltss2.0.8-3.18.1Not reportedSUSE-SU-2022:0825-1Not reported
SuseSDL2rpmlinux enterprise server 15-ltss2.0.8-3.18.1Not reportedSUSE-SU-2022:0825-1Not reported
SuseSDL2rpmlinux enterprise server 15 sp1-bcl2.0.8-3.18.1Not reportedSUSE-SU-2022:0825-1Not reported
SuseSDL2rpmlinux enterprise server 15 sp1-ltss2.0.8-3.18.1Not reportedSUSE-SU-2022:0825-1Not reported
SuseSDL2rpmlinux enterprise server for sap applications 152.0.8-3.18.1Not reportedSUSE-SU-2022:0825-1Not reported
SuseSDL2rpmlinux enterprise server for sap applications 15 sp12.0.8-3.18.1Not reportedSUSE-SU-2022:0825-1Not reported
SuseSDL2rpmenterprise storage 62.0.8-3.18.1Not reportedSUSE-SU-2022:0825-1Not reported
SuseSDLrpmlinux enterprise module for desktop applications 15 sp31.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmlinux enterprise module for package hub 15 sp31.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmlinux enterprise high performance computing 15-espos1.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmlinux enterprise high performance computing 15-ltss1.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmlinux enterprise high performance computing 15 sp1-espos1.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmlinux enterprise high performance computing 15 sp1-ltss1.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmlinux enterprise high performance computing 15 sp2-espos1.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmlinux enterprise high performance computing 15 sp2-ltss1.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmlinux enterprise real time 15 sp21.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmlinux enterprise server 15-ltss1.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmlinux enterprise server 15 sp1-bcl1.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmlinux enterprise server 15 sp1-ltss1.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmlinux enterprise server 15 sp2-bcl1.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmlinux enterprise server 15 sp2-ltss1.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmlinux enterprise server for sap applications 151.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmlinux enterprise server for sap applications 15 sp11.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmlinux enterprise server for sap applications 15 sp21.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmmanager proxy 4.11.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmmanager retail branch server 4.11.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmmanager server 4.11.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmenterprise storage 61.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
SuseSDLrpmenterprise storage 71.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
OpensuseSDLrpmleap 15.31.2.15-150000.3.19.1Not reportedSUSE-SU-2022:1273-1Not reported
Susepdnsrpmpackage hub 15 sp34.3.1-bp153.2.3.1Not reportedOPENSUSE-SU-2022:0104-1Not reported
Opensusepdnsrpmleap 15.34.3.1-bp153.2.3.1Not reportedOPENSUSE-SU-2022:0104-1Not reported
OpensuseSDL2rpmleap 15.32.0.8-11.3.1Not reportedOPENSUSE-SU-2022:0104-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libsdl2-2.0-0]Unknown

    Source package: [libsdl2]

    Details (2)
    • 2.26.5+dfsg-1 · amd64 · bookworm

      Fixed · Fixed: 2.0.14+dfsg2-2

      dsa · libsdl2 · debian · bookworm; dsa · libsdl2 · debian · 12

    • 2.26.5+dfsg-1 · arm64 · bookworm

      Fixed · Fixed: 2.0.14+dfsg2-2

      dsa · libsdl2 · debian · bookworm; dsa · libsdl2 · debian · 12

  • [libsdl2-dev]Unknown

    Source package: [libsdl2]

    Details (2)
    • 2.26.5+dfsg-1 · amd64 · bookworm

      Fixed · Fixed: 2.0.14+dfsg2-2

      dsa · libsdl2 · debian · bookworm; dsa · libsdl2 · debian · 12

    • 2.26.5+dfsg-1 · arm64 · bookworm

      Fixed · Fixed: 2.0.14+dfsg2-2

      dsa · libsdl2 · debian · bookworm; dsa · libsdl2 · debian · 12

  • [libsdl2-doc]Unknown

    Source package: [libsdl2]

    Details (2)
    • 2.26.5+dfsg-1 · all · bookworm

      Fixed · Fixed: 2.0.14+dfsg2-2

      dsa · libsdl2 · debian · bookworm; dsa · libsdl2 · debian · 12

    • 2.26.5+dfsg-1 · all · bookworm

      Fixed · Fixed: 2.0.14+dfsg2-2

      dsa · libsdl2 · debian · bookworm; dsa · libsdl2 · debian · 12

  • [libsdl2-tests]Unknown

    Source package: [libsdl2]

    Details (2)
    • 2.26.5+dfsg-1 · amd64 · bookworm

      Fixed · Fixed: 2.0.14+dfsg2-2

      dsa · libsdl2 · debian · bookworm; dsa · libsdl2 · debian · 12

    • 2.26.5+dfsg-1 · arm64 · bookworm

      Fixed · Fixed: 2.0.14+dfsg2-2

      dsa · libsdl2 · debian · bookworm; dsa · libsdl2 · debian · 12

[Debian 13 (Trixie)]

  • [libsdl2-2.0-0]Unknown

    Source package: [libsdl2]

    Details (2)
    • 2.32.4+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 2.0.14+dfsg2-2

      dsa · libsdl2 · debian · 13

    • 2.32.4+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 2.0.14+dfsg2-2

      dsa · libsdl2 · debian · 13

  • [libsdl2-dev]Unknown

    Source package: [libsdl2]

    Details (2)
    • 2.32.4+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 2.0.14+dfsg2-2

      dsa · libsdl2 · debian · 13

    • 2.32.4+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 2.0.14+dfsg2-2

      dsa · libsdl2 · debian · 13

  • [libsdl2-doc]Unknown

    Source package: [libsdl2]

    Details (2)
    • 2.32.4+dfsg-1 · all · trixie

      Fixed · Fixed: 2.0.14+dfsg2-2

      dsa · libsdl2 · debian · 13

    • 2.32.4+dfsg-1 · all · trixie

      Fixed · Fixed: 2.0.14+dfsg2-2

      dsa · libsdl2 · debian · 13

  • [libsdl2-tests]Unknown

    Source package: [libsdl2]

    Details (2)
    • 2.32.4+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 2.0.14+dfsg2-2

      dsa · libsdl2 · debian · 13

    • 2.32.4+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 2.0.14+dfsg2-2

      dsa · libsdl2 · debian · 13

Observed:

References