Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-2887: SDL_image 2.0.1 can be compromised by malicious XCF files

CVE-2017-2887 · published 9 years ago

Summary

The SDL_image 2.0.1 library that processes XCF image files can be tricked into running incorrect code when it handles a specially crafted file. This could let an attacker take control of the program or cause it to crash. Update to a patched version of SDL_image or avoid opening untrusted XCF files until the fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
libsdl	sdl_image	2.0.1 `cpe:2.3:a:libsdl:sdl_image:2.0.1:::::::*`
debian	debian_linux	8.0 9.0 `cpe:2.3:o:debian:debian_linux:8.0:::::::*`

Original advisory text

An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability.

References

http://www.securityfocus.com/bid/101215 Broken Link
https://www.debian.org/security/2018/dsa-4177 Third Party Advisory
https://www.debian.org/security/2018/dsa-4184 Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0394 Mitigation Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Exploitation

3% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published11 Oct 2017

Updated30 Oct 2026

First seen29 Sep 2026

Sources

CVE-2017-2887 · NVD

Track software like this

Free during beta