CVE catalog

CVE-2021-33657

libsdl1.2: CVE-2021-33657

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.05% · Oct 25, 2026

There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18 versions. By crafting a malicious .BMP file, an attacker can cause the application using this library to crash, denial of service or Code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibsdl2sid2.32.10+dfsg-8fixed
Debianlibsdl2forky2.32.10+dfsg-8fixed
Debianlibsdl2trixie2.32.4+dfsg-1fixed
Debianlibsdl2bookworm2.26.5+dfsg-1fixed
Debianlibsdl1.2bookworm1.2.15+dfsg2-8fixed
Ubuntulibsdl1.2pro1.2.15-11ubuntu1vulnerable
Ubuntulibsdl1.2pro1.2.15-12ubuntu1vulnerable
Ubuntulibsdl1.2pro1.2.15+dfsg1-3vulnerable
Ubuntulibsdl1.2pro1.2.15+dfsg1-3ubuntu0.1vulnerable
Ubuntulibsdl1.2pro1.2.15+dfsg1-3ubuntu0.1+esm1fixed
Ubuntulibsdl1.218.041.2.15+dfsg2-0.1vulnerable
Ubuntulibsdl1.218.041.2.15+dfsg2-0.1ubuntu0.1vulnerable
Ubuntulibsdl1.218.041.2.15+dfsg2-0.1ubuntu0.2fixed
Ubuntulibsdl1.2pro1.2.15-11ubuntu1vulnerable
Ubuntulibsdl1.2pro1.2.15-12ubuntu1vulnerable
Ubuntulibsdl1.2pro1.2.15+dfsg1-3vulnerable
Ubuntulibsdl1.2pro1.2.15+dfsg1-3ubuntu0.1vulnerable
Ubuntulibsdl1.2pro1.2.15+dfsg1-3ubuntu0.1+esm1fixed
Ubuntulibsdl2pro2.0.10+dfsg1-1ubuntu1vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-1ubuntu4vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-1ubuntu6vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-1ubuntu7vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-1ubuntu8vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-2ubuntu5vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-3vulnerable
Ubuntulibsdl2pro2.0.10+dfsg1-3ubuntu0.1~esm1vulnerable
Ubuntulibsdl216.042.0.2+dfsg1-6ubuntu2vulnerable
Ubuntulibsdl216.042.0.4+dfsg1-2vulnerable
Ubuntulibsdl216.042.0.4+dfsg1-2ubuntu1vulnerable
Ubuntulibsdl216.042.0.4+dfsg1-2ubuntu2vulnerable
Ubuntulibsdl216.042.0.4+dfsg1-2ubuntu2.16.04.1vulnerable
Ubuntulibsdl216.042.0.4+dfsg1-2ubuntu2.16.04.2vulnerable
Ubuntulibsdl1.218.041.2.15+dfsg2-0.1vulnerable
Ubuntulibsdl1.218.041.2.15+dfsg2-0.1ubuntu0.1vulnerable
Ubuntulibsdl1.218.041.2.15+dfsg2-0.1ubuntu0.2fixed
Ubuntulibsdl1.220.041.2.15+dfsg2-5vulnerable
Ubuntulibsdl1.222.041.2.15+dfsg2-6vulnerable
SuseSDL2linux enterprise high performance computing 15-espos2.0.8-150000.3.21.1fixed
SuseSDL2linux enterprise high performance computing 15-ltss2.0.8-150000.3.21.1fixed
SuseSDL2linux enterprise high performance computing 15 sp1-espos2.0.8-150000.3.21.1fixed
SuseSDL2linux enterprise high performance computing 15 sp1-ltss2.0.8-150000.3.21.1fixed
SuseSDL2linux enterprise server 15-ltss2.0.8-150000.3.21.1fixed
SuseSDL2linux enterprise server 15 sp1-bcl2.0.8-150000.3.21.1fixed
SuseSDL2linux enterprise server 15 sp1-ltss2.0.8-150000.3.21.1fixed
SuseSDL2linux enterprise server for sap applications 152.0.8-150000.3.21.1fixed
SuseSDL2linux enterprise server for sap applications 15 sp12.0.8-150000.3.21.1fixed
SuseSDL2enterprise storage 62.0.8-150000.3.21.1fixed
SuseSDL2linux enterprise module for desktop applications 15 sp32.0.8-150200.11.6.1fixed
SuseSDL2linux enterprise module for package hub 15 sp32.0.8-150200.11.6.1fixed
SuseSDL2linux enterprise module for package hub 15 sp42.0.8-150200.11.6.1fixed
SuseSDL2linux enterprise high performance computing 15 sp2-espos2.0.8-150200.11.6.1fixed
SuseSDL2linux enterprise high performance computing 15 sp2-ltss2.0.8-150200.11.6.1fixed
SuseSDL2linux enterprise real time 15 sp22.0.8-150200.11.6.1fixed
SuseSDL2linux enterprise server 15 sp2-bcl2.0.8-150200.11.6.1fixed
SuseSDL2linux enterprise server 15 sp2-ltss2.0.8-150200.11.6.1fixed
SuseSDL2linux enterprise server for sap applications 15 sp22.0.8-150200.11.6.1fixed
SuseSDL2manager proxy 4.12.0.8-150200.11.6.1fixed
SuseSDL2manager retail branch server 4.12.0.8-150200.11.6.1fixed
SuseSDL2manager server 4.12.0.8-150200.11.6.1fixed
SuseSDL2enterprise storage 72.0.8-150200.11.6.1fixed
OpensuseSDL2leap 15.32.0.8-150200.11.6.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibsdl2sourcesid2.0.20+dfsg-2not yet assignedNot reportedNot reported
Debianlibsdl2sourceforky2.0.20+dfsg-2not yet assignedNot reportedNot reported
Debianlibsdl2sourcetrixie2.0.20+dfsg-2not yet assignedNot reportedNot reported
Debianlibsdl2sourcebookworm2.0.20+dfsg-2not yet assignedNot reportedNot reported
Debianlibsdl1.2sourcebookworm1.2.15+dfsg2-7not yet assignedNot reported[1014577]
Ubuntulibsdl1.2debpro1.2.15+dfsg1-3ubuntu0.1+esm1Not reportedUSN-5398-1Not reported
Ubuntulibsdl1.2deb18.041.2.15+dfsg2-0.1ubuntu0.2Not reportedUSN-5398-1Not reported
Ubuntulibsdl1.2debpro1.2.15+dfsg1-3ubuntu0.1+esm1Not reportedUBUNTU-CVE-2021-33657Not reported
Ubuntulibsdl1.2deb18.041.2.15+dfsg2-0.1ubuntu0.2Not reportedUBUNTU-CVE-2021-33657Not reported
SuseSDL2rpmlinux enterprise high performance computing 15-espos2.0.8-150000.3.21.1Not reportedSUSE-SU-2022:1313-1Not reported
SuseSDL2rpmlinux enterprise high performance computing 15-ltss2.0.8-150000.3.21.1Not reportedSUSE-SU-2022:1313-1Not reported
SuseSDL2rpmlinux enterprise high performance computing 15 sp1-espos2.0.8-150000.3.21.1Not reportedSUSE-SU-2022:1313-1Not reported
SuseSDL2rpmlinux enterprise high performance computing 15 sp1-ltss2.0.8-150000.3.21.1Not reportedSUSE-SU-2022:1313-1Not reported
SuseSDL2rpmlinux enterprise server 15-ltss2.0.8-150000.3.21.1Not reportedSUSE-SU-2022:1313-1Not reported
SuseSDL2rpmlinux enterprise server 15 sp1-bcl2.0.8-150000.3.21.1Not reportedSUSE-SU-2022:1313-1Not reported
SuseSDL2rpmlinux enterprise server 15 sp1-ltss2.0.8-150000.3.21.1Not reportedSUSE-SU-2022:1313-1Not reported
SuseSDL2rpmlinux enterprise server for sap applications 152.0.8-150000.3.21.1Not reportedSUSE-SU-2022:1313-1Not reported
SuseSDL2rpmlinux enterprise server for sap applications 15 sp12.0.8-150000.3.21.1Not reportedSUSE-SU-2022:1313-1Not reported
SuseSDL2rpmenterprise storage 62.0.8-150000.3.21.1Not reportedSUSE-SU-2022:1313-1Not reported
SuseSDL2rpmlinux enterprise module for desktop applications 15 sp32.0.8-150200.11.6.1Not reportedSUSE-SU-2022:1218-1Not reported
SuseSDL2rpmlinux enterprise module for package hub 15 sp32.0.8-150200.11.6.1Not reportedSUSE-SU-2022:1218-1Not reported
SuseSDL2rpmlinux enterprise module for package hub 15 sp42.0.8-150200.11.6.1Not reportedSUSE-SU-2022:1218-1Not reported
SuseSDL2rpmlinux enterprise high performance computing 15 sp2-espos2.0.8-150200.11.6.1Not reportedSUSE-SU-2022:1218-1Not reported
SuseSDL2rpmlinux enterprise high performance computing 15 sp2-ltss2.0.8-150200.11.6.1Not reportedSUSE-SU-2022:1218-1Not reported
SuseSDL2rpmlinux enterprise real time 15 sp22.0.8-150200.11.6.1Not reportedSUSE-SU-2022:1218-1Not reported
SuseSDL2rpmlinux enterprise server 15 sp2-bcl2.0.8-150200.11.6.1Not reportedSUSE-SU-2022:1218-1Not reported
SuseSDL2rpmlinux enterprise server 15 sp2-ltss2.0.8-150200.11.6.1Not reportedSUSE-SU-2022:1218-1Not reported
SuseSDL2rpmlinux enterprise server for sap applications 15 sp22.0.8-150200.11.6.1Not reportedSUSE-SU-2022:1218-1Not reported
SuseSDL2rpmmanager proxy 4.12.0.8-150200.11.6.1Not reportedSUSE-SU-2022:1218-1Not reported
SuseSDL2rpmmanager retail branch server 4.12.0.8-150200.11.6.1Not reportedSUSE-SU-2022:1218-1Not reported
SuseSDL2rpmmanager server 4.12.0.8-150200.11.6.1Not reportedSUSE-SU-2022:1218-1Not reported
SuseSDL2rpmenterprise storage 72.0.8-150200.11.6.1Not reportedSUSE-SU-2022:1218-1Not reported
OpensuseSDL2rpmleap 15.32.0.8-150200.11.6.1Not reportedSUSE-SU-2022:1218-1Not reported

[Debian bug #1014577]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libsdl1.2debian]Fixed

    Source package: [libsdl1.2]

    Details (2)

    • 1.2.15+dfsg2-8 · amd64 · bookworm

      Fixed · Fixed: 1.2.15+dfsg2-7

      dsa · libsdl1.2 · debian · bookworm; dsa · libsdl1.2 · debian · 12

    • 1.2.15+dfsg2-8 · arm64 · bookworm

      Fixed · Fixed: 1.2.15+dfsg2-7

      dsa · libsdl1.2 · debian · bookworm; dsa · libsdl1.2 · debian · 12

  • [libsdl1.2-dev]Fixed

    Source package: [libsdl1.2]

    Details (2)

    • 1.2.15+dfsg2-8 · amd64 · bookworm

      Fixed · Fixed: 1.2.15+dfsg2-7

      dsa · libsdl1.2 · debian · bookworm; dsa · libsdl1.2 · debian · 12

    • 1.2.15+dfsg2-8 · arm64 · bookworm

      Fixed · Fixed: 1.2.15+dfsg2-7

      dsa · libsdl1.2 · debian · bookworm; dsa · libsdl1.2 · debian · 12

  • [libsdl2-2.0-0]Fixed

    Source package: [libsdl2]

    Details (2)

    • 2.26.5+dfsg-1 · amd64 · bookworm

      Fixed · Fixed: 2.0.20+dfsg-2

      dsa · libsdl2 · debian · bookworm; dsa · libsdl2 · debian · 12

    • 2.26.5+dfsg-1 · arm64 · bookworm

      Fixed · Fixed: 2.0.20+dfsg-2

      dsa · libsdl2 · debian · bookworm; dsa · libsdl2 · debian · 12

  • [libsdl2-dev]Fixed

    Source package: [libsdl2]

    Details (2)

    • 2.26.5+dfsg-1 · amd64 · bookworm

      Fixed · Fixed: 2.0.20+dfsg-2

      dsa · libsdl2 · debian · bookworm; dsa · libsdl2 · debian · 12

    • 2.26.5+dfsg-1 · arm64 · bookworm

      Fixed · Fixed: 2.0.20+dfsg-2

      dsa · libsdl2 · debian · bookworm; dsa · libsdl2 · debian · 12

  • [libsdl2-doc]Fixed

    Source package: [libsdl2]

    Details (2)

    • 2.26.5+dfsg-1 · all · bookworm

      Fixed · Fixed: 2.0.20+dfsg-2

      dsa · libsdl2 · debian · bookworm; dsa · libsdl2 · debian · 12

    • 2.26.5+dfsg-1 · all · bookworm

      Fixed · Fixed: 2.0.20+dfsg-2

      dsa · libsdl2 · debian · bookworm; dsa · libsdl2 · debian · 12

  • [libsdl2-tests]Fixed

    Source package: [libsdl2]

    Details (2)

    • 2.26.5+dfsg-1 · amd64 · bookworm

      Fixed · Fixed: 2.0.20+dfsg-2

      dsa · libsdl2 · debian · bookworm; dsa · libsdl2 · debian · 12

    • 2.26.5+dfsg-1 · arm64 · bookworm

      Fixed · Fixed: 2.0.20+dfsg-2

      dsa · libsdl2 · debian · bookworm; dsa · libsdl2 · debian · 12

[Debian 13 (Trixie)]

  • [libsdl2-2.0-0]Fixed

    Source package: [libsdl2]

    Details (2)

    • 2.32.4+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 2.0.20+dfsg-2

      dsa · libsdl2 · debian · 13

    • 2.32.4+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 2.0.20+dfsg-2

      dsa · libsdl2 · debian · 13

  • [libsdl2-dev]Fixed

    Source package: [libsdl2]

    Details (2)

    • 2.32.4+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 2.0.20+dfsg-2

      dsa · libsdl2 · debian · 13

    • 2.32.4+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 2.0.20+dfsg-2

      dsa · libsdl2 · debian · 13

  • [libsdl2-doc]Fixed

    Source package: [libsdl2]

    Details (2)

    • 2.32.4+dfsg-1 · all · trixie

      Fixed · Fixed: 2.0.20+dfsg-2

      dsa · libsdl2 · debian · 13

    • 2.32.4+dfsg-1 · all · trixie

      Fixed · Fixed: 2.0.20+dfsg-2

      dsa · libsdl2 · debian · 13

  • [libsdl2-tests]Fixed

    Source package: [libsdl2]

    Details (2)

    • 2.32.4+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 2.0.20+dfsg-2

      dsa · libsdl2 · debian · 13

    • 2.32.4+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 2.0.20+dfsg-2

      dsa · libsdl2 · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]