Security update for SDL

Announcement ID:	SUSE-SU-2019:0899-1
Rating:	moderate
References:	bsc#1124799 bsc#1124800 bsc#1124802 bsc#1124803 bsc#1124805 bsc#1124806 bsc#1124824 bsc#1124825 bsc#1124826 bsc#1124827 bsc#1125099
Cross-References:	CVE-2019-7572 CVE-2019-7573 CVE-2019-7574 CVE-2019-7575 CVE-2019-7576 CVE-2019-7577 CVE-2019-7578 CVE-2019-7635 CVE-2019-7636 CVE-2019-7637 CVE-2019-7638
CVSS scores:	CVE-2019-7572 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-7572 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7572 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7573 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-7573 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7573 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7574 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-7574 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7574 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7575 ( SUSE ): 5.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2019-7575 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7575 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7576 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-7576 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7576 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7577 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-7577 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7577 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7578 ( SUSE ): 5.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2019-7578 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2019-7578 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7635 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-7635 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2019-7635 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7636 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-7636 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2019-7636 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7637 ( SUSE ): 5.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2019-7637 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7638 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-7638 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7638 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:	SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP4

An update that solves 11 vulnerabilities can now be installed.

Description:

This update for SDL fixes the following issues:

Security issues fixed:

• CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).
• CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).
• CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).
• CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).
• CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).
• CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).
• CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).
• CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).
• CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).
• CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).
• CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Desktop 12 SP3
  zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2019-899=1
• SUSE Linux Enterprise Desktop 12 SP4
  zypper in -t patch SUSE-SLE-DESKTOP-12-SP4-2019-899=1
• SUSE Linux Enterprise Software Development Kit 12 SP3
  zypper in -t patch SUSE-SLE-SDK-12-SP3-2019-899=1
• SUSE Linux Enterprise Software Development Kit 12 SP4
  zypper in -t patch SUSE-SLE-SDK-12-SP4-2019-899=1
• SUSE Linux Enterprise Server 12 SP3
  zypper in -t patch SUSE-SLE-SERVER-12-SP3-2019-899=1
• SUSE Linux Enterprise High Performance Computing 12 SP3
  zypper in -t patch SUSE-SLE-SERVER-12-SP3-2019-899=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP3
  zypper in -t patch SUSE-SLE-SERVER-12-SP3-2019-899=1
• SUSE Linux Enterprise High Performance Computing 12 SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-2019-899=1
• SUSE Linux Enterprise Server 12 SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-2019-899=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-2019-899=1

Package List:

• SUSE Linux Enterprise Desktop 12 SP3 (x86_64)
  • libSDL-1_2-0-1.2.15-15.11.1
  • libSDL-1_2-0-debuginfo-1.2.15-15.11.1
  • SDL-debugsource-1.2.15-15.11.1
• SUSE Linux Enterprise Desktop 12 SP4 (x86_64)
  • libSDL-1_2-0-1.2.15-15.11.1
  • libSDL-1_2-0-debuginfo-1.2.15-15.11.1
  • SDL-debugsource-1.2.15-15.11.1
• SUSE Linux Enterprise Software Development Kit 12 SP3 (aarch64 ppc64le s390x x86_64)
  • libSDL-devel-1.2.15-15.11.1
  • SDL-debugsource-1.2.15-15.11.1
• SUSE Linux Enterprise Software Development Kit 12 SP4 (aarch64 ppc64le s390x x86_64)
  • libSDL-devel-1.2.15-15.11.1
  • SDL-debugsource-1.2.15-15.11.1
• SUSE Linux Enterprise Server 12 SP3 (aarch64 ppc64le s390x x86_64)
  • libSDL-1_2-0-1.2.15-15.11.1
  • libSDL-1_2-0-debuginfo-1.2.15-15.11.1
  • SDL-debugsource-1.2.15-15.11.1
• SUSE Linux Enterprise Server 12 SP3 (s390x x86_64)
  • libSDL-1_2-0-32bit-1.2.15-15.11.1
  • libSDL-1_2-0-debuginfo-32bit-1.2.15-15.11.1
• SUSE Linux Enterprise High Performance Computing 12 SP3 (aarch64 x86_64)
  • libSDL-1_2-0-1.2.15-15.11.1
  • libSDL-1_2-0-debuginfo-1.2.15-15.11.1
  • SDL-debugsource-1.2.15-15.11.1
• SUSE Linux Enterprise High Performance Computing 12 SP3 (x86_64)
  • libSDL-1_2-0-32bit-1.2.15-15.11.1
  • libSDL-1_2-0-debuginfo-32bit-1.2.15-15.11.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP3 (ppc64le x86_64)
  • libSDL-1_2-0-1.2.15-15.11.1
  • libSDL-1_2-0-debuginfo-1.2.15-15.11.1
  • SDL-debugsource-1.2.15-15.11.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP3 (x86_64)
  • libSDL-1_2-0-32bit-1.2.15-15.11.1
  • libSDL-1_2-0-debuginfo-32bit-1.2.15-15.11.1
• SUSE Linux Enterprise High Performance Computing 12 SP4 (aarch64 x86_64)
  • libSDL-1_2-0-1.2.15-15.11.1
  • libSDL-1_2-0-debuginfo-1.2.15-15.11.1
  • SDL-debugsource-1.2.15-15.11.1
• SUSE Linux Enterprise High Performance Computing 12 SP4 (x86_64)
  • libSDL-1_2-0-32bit-1.2.15-15.11.1
  • libSDL-1_2-0-debuginfo-32bit-1.2.15-15.11.1
• SUSE Linux Enterprise Server 12 SP4 (aarch64 ppc64le s390x x86_64)
  • libSDL-1_2-0-1.2.15-15.11.1
  • libSDL-1_2-0-debuginfo-1.2.15-15.11.1
  • SDL-debugsource-1.2.15-15.11.1
• SUSE Linux Enterprise Server 12 SP4 (s390x x86_64)
  • libSDL-1_2-0-32bit-1.2.15-15.11.1
  • libSDL-1_2-0-debuginfo-32bit-1.2.15-15.11.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4 (ppc64le x86_64)
  • libSDL-1_2-0-1.2.15-15.11.1
  • libSDL-1_2-0-debuginfo-1.2.15-15.11.1
  • SDL-debugsource-1.2.15-15.11.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4 (x86_64)
  • libSDL-1_2-0-32bit-1.2.15-15.11.1
  • libSDL-1_2-0-debuginfo-32bit-1.2.15-15.11.1

References:

• https://www.suse.com/security/cve/CVE-2019-7572.html
• https://www.suse.com/security/cve/CVE-2019-7573.html
• https://www.suse.com/security/cve/CVE-2019-7574.html
• https://www.suse.com/security/cve/CVE-2019-7575.html
• https://www.suse.com/security/cve/CVE-2019-7576.html
• https://www.suse.com/security/cve/CVE-2019-7577.html
• https://www.suse.com/security/cve/CVE-2019-7578.html
• https://www.suse.com/security/cve/CVE-2019-7635.html
• https://www.suse.com/security/cve/CVE-2019-7636.html
• https://www.suse.com/security/cve/CVE-2019-7637.html
• https://www.suse.com/security/cve/CVE-2019-7638.html
• https://bugzilla.suse.com/show_bug.cgi?id=1124799
• https://bugzilla.suse.com/show_bug.cgi?id=1124800
• https://bugzilla.suse.com/show_bug.cgi?id=1124802
• https://bugzilla.suse.com/show_bug.cgi?id=1124803
• https://bugzilla.suse.com/show_bug.cgi?id=1124805
• https://bugzilla.suse.com/show_bug.cgi?id=1124806
• https://bugzilla.suse.com/show_bug.cgi?id=1124824
• https://bugzilla.suse.com/show_bug.cgi?id=1124825
• https://bugzilla.suse.com/show_bug.cgi?id=1124826
• https://bugzilla.suse.com/show_bug.cgi?id=1124827
• https://bugzilla.suse.com/show_bug.cgi?id=1125099