リモートホストにインストールされているテスト済み製品のバージョンは、テスト済みバージョンより前です。したがって、ALAS2-2020-1500のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - 1.2.15までおよび2.x～2.0.9のSDL（Simple DirectMedia Layer）では、audio/SDL_wave.cのIMA_ADPCM_nibbleにバッファオーバーリードがあります。（CVE-2019-7572）

  - 1.2.15までおよび2.x～2.0.9のSDL (Simple DirectMedia Layer ) では、audio/SDL_wave.c (wNumCoefループ内 ) のInitMS_ADPCMにヒープベースのバッファオーバーリードがあります。 (CVE-2019-7573 )

  - 1.2.15までおよび2.x～2.0.9のSDL (Simple DirectMedia Layer ) では、audio/SDL_wave.cのIMA_ADPCM_decodeにヒープベースのバッファオーバーリードがあります。 (CVE-2019-7574 )

  - 1.2.15までおよび2.x～2.0.9のSDL (Simple DirectMedia Layer ) では、 audio/SDL_wave.cのMS_ADPCM_decodeにヒープベースのバッファオーバーリードがあります。 (CVE-2019-7575 )

  - 1.2.15までおよび2.x～2.0.9のSDL (Simple DirectMedia Layer ) では、audio/SDL_wave.c (wNumCoefループ外 ) のInitMS_ADPCMにヒープベースのバッファオーバーリードがあります。 (CVE-2019-7576 )

  - 1.2.15までおよび2.x～2.0.9のSDL (Simple DirectMedia Layer ) では、 audio/SDL_wave.cのSDL_LoadWAV_RWにヒープベースのバッファオーバーリードがあります。 (CVE-2019-7577 )

  - 1.2.15までおよび2.x～2.0.9のSDL (Simple DirectMedia Layer ) では、 audio/SDL_wave.cのInitIMA_ADPCMにヒープベースのバッファオーバーリードがあります。 (CVE-2019-7578 )

  - 1.2.15までおよび2.x～2.0.9のSDL (Simple DirectMedia Layer ) では、 video/SDL_blit_1.cのBlit1to4にヒープベースのバッファオーバーリードがあります。 (CVE-2019-7635 )

  - 1.2.15までおよび2.x～2.0.9のSDL (Simple DirectMedia Layer ) では、 video/SDL_pixels.cのSDL_GetRGBにヒープベースのバッファオーバーリードがあります。 (CVE-2019-7636 )

  - 1.2.15までおよび2.x～2.0.9のSDL (Simple DirectMedia Layer ) では、 video/SDL_surface.cのSDL_FillRectにヒープベースのバッファオーバーリードがあります。 (CVE-2019-7637 )

  - 1.2.15までおよび2.x～2.0.9のSDL (Simple DirectMedia Layer ) では、 video/SDL_pixels.cのMap1toNにヒープベースのバッファオーバーリードがあります。 (CVE-2019-7638 )

Nessusはこの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

このリリースでは、破損した波形オーディオおよびBMP画像ファイルを解析または処理する際の、さまざまなバッファオーバーフローを修正します。

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

SDL 2.0が細工された画像ファイルを不適切に処理し、整数オーバーフローを引き起こすことがわかりました。ユーザーがだまされて悪意のあるファイルを開いた場合に、SDL 2.0 がクラッシュしたり、任意のコードが実行されたりする可能性があります。(CVE-2017-2888)

SDL 2.0が細工された画像ファイルを不適切に処理することがわかりました。ユーザーがだまされて悪意のあるファイルを開いた場合に、SDL 2.0 がクラッシュしたり、任意のコードが実行されたりする可能性があります。(CVE-2019-7635、CVE-2019-7636、CVE-2019-7637、CVE-2019-7638)。

注意: Tenable Network Security は、前述の説明ブロックを Ubuntu セキュリティアドバイザリからすでに直接抽出しています。Tenable では、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

リモートのCentOS Linux 8ホストにインストールされているパッケージは、CESA-2020: 4627のアドバイザリに記載されている脆弱性の影響を受けます。

  - SDL: IMA_ADPCM_nibbleaudio/SDL_wave.c内のIMA_ADPCM_nibbleで発生するバッファオーバーリード（CVE-2019-7572）

  - SDL: audio/SDL_wave.c内のInitMS_ADPCMで発生するヒープベースのバッファオーバーリード（CVE-2019-7573、CVE-2019-7576）

  - SDL: audio/SDL_wave.c内のIMA_ADPCM_decodeで発生するヒープベースのバッファオーバーリード（CVE-2019-7574）

  - SDL: MS_ADPCM_decode in audio/SDL_wave.cで発生するヒープベースのバッファオーバーフロー（CVE-2019-7575）

  - SDL: audio/SDL_wave.cのSDL_LoadWAV_RWで発生するバッファオーバーリード（CVE-2019-7577）

  - SDL: audio/SDL_wave.c内のInitMS_ADPCMで発生するヒープベースのバッファオーバーリード（CVE-2019-7578）

  - SDL: video/SDL_blit_1.c内のBlit1to4で発生するヒープベースのバッファオーバーリード（CVE-2019-7635）

  - SDL: video/SDL_pixels.c内のSDL_GetRGBで発生するヒープベースのバッファオーバーリード（CVE-2019-7636）

  - SDL: video/SDL_surface.c内のSDL_FillRectで発生するヒープベースのバッファオーバーフロー（CVE-2019-7637）

  - SDL: video/SDL_pixels.c内のMap1toNで発生するヒープベースのバッファオーバーリード（CVE-2019-7638）

Nessusはこの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

The remote NewStart CGSL host, running version MAIN 6.02, has SDL packages installed that are affected by multiple vulnerabilities:

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     IMA_ADPCM_decode in audio/SDL_wave.c. (CVE-2019-7574)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in     SDL_LoadWAV_RW in audio/SDL_wave.c. (CVE-2019-7577)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitIMA_ADPCM in audio/SDL_wave.c. (CVE-2019-7578)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     Map1toN in video/SDL_pixels.c. (CVE-2019-7638)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     SDL_GetRGB in video/SDL_pixels.c. (CVE-2019-7636)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     Blit1to4 in video/SDL_blit_1.c. (CVE-2019-7635)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in     SDL_FillRect in video/SDL_surface.c. (CVE-2019-7637)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in     MS_ADPCM_decode in audio/SDL_wave.c. (CVE-2019-7575)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef loop). (CVE-2019-7573)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in     IMA_ADPCM_nibble in audio/SDL_wave.c. (CVE-2019-7572)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop). (CVE-2019-7576)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3868 advisory.

    - Fix Some CVEs: CVE-2019-7572, CVE-2019-7573, CVE-2019-7574,       CVE-2019-7575, CVE-2019-7576, CVE-2019-7577, CVE-2019-7578,       CVE-2019-7635, CVE-2019-7636, CVE-2019-7637, CVE-2019-7638

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of SDL installed on the remote host is prior to 1.2.15-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1500 advisory.

    SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in     IMA_ADPCM_nibble in audio/SDL_wave.c. (CVE-2019-7572)

    SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef loop). (CVE-2019-7573)

    SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     IMA_ADPCM_decode in audio/SDL_wave.c. (CVE-2019-7574)

    SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in     MS_ADPCM_decode in audio/SDL_wave.c. (CVE-2019-7575)

    SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop). (CVE-2019-7576)

    SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in     SDL_LoadWAV_RW in audio/SDL_wave.c. (CVE-2019-7577)

    SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitIMA_ADPCM in audio/SDL_wave.c. (CVE-2019-7578)

    SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     Blit1to4 in video/SDL_blit_1.c. (CVE-2019-7635)

    SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     SDL_GetRGB in video/SDL_pixels.c. (CVE-2019-7636)

    SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in     SDL_FillRect in video/SDL_surface.c. (CVE-2019-7637)

    SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     Map1toN in video/SDL_pixels.c. (CVE-2019-7638)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This release fixes various buffer overflows when parsing or processing damaged Waveform audio and BMP image files.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the SDL package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x     through 2.0.9 has a heap-based buffer over-read in     InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef     loop).(CVE-2019-7573)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x     through 2.0.9 has a heap-based buffer over-read in     InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef     loop).(CVE-2019-7576)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x     through 2.0.9 has a buffer over-read in SDL_LoadWAV_RW     in audio/SDL_wave.c.(CVE-2019-7577)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x     through 2.0.9 has a heap-based buffer over-read in     InitIMA_ADPCM in audio/SDL_wave.c.(CVE-2019-7578)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x     through 2.0.9 has a heap-based buffer over-read in     Blit1to4 in video/SDL_blit_1.c.(CVE-2019-7635)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x     through 2.0.9 has a heap-based buffer over-read in     Map1toN in video/SDL_pixels.c.(CVE-2019-7638)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x     through 2.0.9 has a heap-based buffer over-read in     SDL_GetRGB in video/SDL_pixels.c.(CVE-2019-7636)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x     through 2.0.9 has a heap-based buffer overflow in     SDL_FillRect in video/SDL_surface.c.(CVE-2019-7637)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4143-1 advisory.

    It was discovered that SDL 2.0 mishandled crafted image files resulting in an integer overflow. If a user     were tricked into opening a malicious file, SDL 2.0 could be caused to crash or potentially run arbitrary     code. (CVE-2017-2888)

    It was discovered that SDL 2.0 mishandled crafted image files. If a user were

    tricked into opening a malicious file, SDL 2.0 could be caused to crash or

    potentially run arbitrary code. (CVE-2019-7635, CVE-2019-7636, CVE-2019-7637, CVE-2019-7638)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for SDL fixes the following issues :

Security issues fixed :

CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).

CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).

CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).

CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).

CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).

CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).

CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).

CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).

CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).

CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).

CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for SDL2 fixes the following issues :

Security issues fixed :

  - CVE-2019-7572: Fixed a buffer over-read in     IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).

  - CVE-2019-7578: Fixed a heap-based buffer over-read in     InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).

  - CVE-2019-7576: Fixed heap-based buffer over-read in     InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).

  - CVE-2019-7573: Fixed a heap-based buffer over-read in     InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).

  - CVE-2019-7635: Fixed a heap-based buffer over-read in     Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).

  - CVE-2019-7636: Fixed a heap-based buffer over-read in     SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).

  - CVE-2019-7638: Fixed a heap-based buffer over-read in     Map1toN in video/SDL_pixels.c (bsc#1124824).

  - CVE-2019-7574: Fixed a heap-based buffer over-read in     IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).

  - CVE-2019-7575: Fixed a heap-based buffer overflow in     MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).

  - CVE-2019-7637: Fixed a heap-based buffer overflow in     SDL_FillRect function in SDL_surface.c (bsc#1124825).

  - CVE-2019-7577: Fixed a buffer over read in     SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).

This update was imported from the SUSE:SLE-15:Update update project.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4627 advisory.

  - SDL: buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c (CVE-2019-7572)

  - SDL: heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (CVE-2019-7573, CVE-2019-7576)

  - SDL: heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (CVE-2019-7574)

  - SDL: heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (CVE-2019-7575)

  - SDL: buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c (CVE-2019-7577)

  - SDL: heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (CVE-2019-7578)

  - SDL: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c (CVE-2019-7635)

  - SDL: heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (CVE-2019-7636)

  - SDL: heap-based buffer overflow in SDL_FillRect in video/SDL_surface.c (CVE-2019-7637)

  - SDL: heap-based buffer over-read in Map1toN in video/SDL_pixels.c (CVE-2019-7638)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
141985	Amazon Linux 2: SDL（ALAS-2020-1500）	Nessus	Amazon Linux Local Security Checks	2020/10/28	2024/12/11	high
122439	Fedora 29：SDL（2019-7a554204c1）	Nessus	Fedora Local Security Checks	2019/2/26	2024/6/18	high
129489	Ubuntu 16.04 LTS / 18.04 LTS : SDL 2.0 の脆弱性 (USN-4143-1)	Nessus	Ubuntu Local Security Checks	2019/10/1	2024/8/27	high
146035	CentOS 8：SDL（CESA-2020: 4627）	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/24	high
147263	NewStart CGSL MAIN 6.02 : SDL Multiple Vulnerabilities (NS-SA-2021-0077)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2024/1/16	high
141228	Oracle Linux 7 : SDL (ELSA-2020-3868)	Nessus	Oracle Linux Local Security Checks	2020/10/7	2024/10/23	high
141985	Amazon Linux 2 : SDL (ALAS-2020-1500)	Nessus	Amazon Linux Local Security Checks	2020/10/28	2024/12/11	high
122439	Fedora 29 : SDL (2019-7a554204c1)	Nessus	Fedora Local Security Checks	2019/2/26	2024/6/18	high
124793	EulerOS Virtualization 3.0.1.0 : SDL (EulerOS-SA-2019-1469)	Nessus	Huawei Local Security Checks	2019/5/13	2024/5/23	high
129489	Ubuntu 16.04 LTS / 18.04 LTS : SDL 2.0 vulnerabilities (USN-4143-1)	Nessus	Ubuntu Local Security Checks	2019/10/1	2024/8/27	high
123925	SUSE SLED12 / SLES12 Security Update : SDL (SUSE-SU-2019:0899-1)	Nessus	SuSE Local Security Checks	2019/4/9	2024/6/4	high
124267	openSUSE Security Update : SDL2 (openSUSE-2019-1261)	Nessus	SuSE Local Security Checks	2019/4/24	2024/5/31	high
146035	CentOS 8 : SDL (CESA-2020:4627)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/24	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high