openSUSE Security Update: Security update for SDL2, SDL2_image
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2018:0734-1
Rating:             important
References:         #1025413 #1084256 #1084257 #1084282 #1084288 
                    #1084297 #1084303 #1084304 
Cross-References:   CVE-2017-12122 CVE-2017-14440 CVE-2017-14441
                    CVE-2017-14442 CVE-2017-14448 CVE-2017-14449
                    CVE-2017-14450
Affected Products:
                    openSUSE Leap 42.3
______________________________________________________________________________

   An update that solves 7 vulnerabilities and has one errata
   is now available.

Description:

   This update for SDL2 and SDL2_image fixes the following issues:

   - CVE-2017-14441: Code execution in the ICO image rendering (bsc#1084282).
   - CVE-2017-14440: Potential code execution in the ILBM image rendering
     functionality (bsc#1084257).
   - CVE-2017-12122: Potential code execution in the ILBM image rendering
     fuctionality (bsc#1084256).
   - CVE-2017-14448: Heap buffer overflow in the XCF image rendering
     functionality (bsc#1084303).
   - CVE-2017-14449: Double-Free in the XCF image rendering (bsc#1084297).
   - CVE-2017-14442: Stack buffer overflow the BMP image rendering
     functionality (bsc#1084304).
   - CVE-2017-14450: Buffer overflow in the GIF image parsing (bsc#1084288).

   Bug fixes:

   - boo#1025413: Add dbus-ime.diff and build with fcitx.


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE Leap 42.3:

      zypper in -t patch openSUSE-2018-280=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE Leap 42.3 (i586 x86_64):

      SDL2-debugsource-2.0.8-18.1
      SDL2_image-debugsource-2.0.3-13.10.1
      libSDL2-2_0-0-2.0.8-18.1
      libSDL2-2_0-0-debuginfo-2.0.8-18.1
      libSDL2-devel-2.0.8-18.1
      libSDL2_image-2_0-0-2.0.3-13.10.1
      libSDL2_image-2_0-0-debuginfo-2.0.3-13.10.1
      libSDL2_image-devel-2.0.3-13.10.1

   - openSUSE Leap 42.3 (x86_64):

      libSDL2-2_0-0-32bit-2.0.8-18.1
      libSDL2-2_0-0-debuginfo-32bit-2.0.8-18.1
      libSDL2-devel-32bit-2.0.8-18.1
      libSDL2_image-2_0-0-32bit-2.0.3-13.10.1
      libSDL2_image-2_0-0-debuginfo-32bit-2.0.3-13.10.1
      libSDL2_image-devel-32bit-2.0.3-13.10.1


References:

   https://www.suse.com/security/cve/CVE-2017-12122.html
   https://www.suse.com/security/cve/CVE-2017-14440.html
   https://www.suse.com/security/cve/CVE-2017-14441.html
   https://www.suse.com/security/cve/CVE-2017-14442.html
   https://www.suse.com/security/cve/CVE-2017-14448.html
   https://www.suse.com/security/cve/CVE-2017-14449.html
   https://www.suse.com/security/cve/CVE-2017-14450.html
   https://bugzilla.suse.com/1025413
   https://bugzilla.suse.com/1084256
   https://bugzilla.suse.com/1084257
   https://bugzilla.suse.com/1084282
   https://bugzilla.suse.com/1084288
   https://bugzilla.suse.com/1084297
   https://bugzilla.suse.com/1084303
   https://bugzilla.suse.com/1084304

--