Security update for SDL

Announcement ID:	SUSE-SU-2019:13998-1
Rating:	moderate
References:	bsc#1124799 bsc#1124800 bsc#1124802 bsc#1124803 bsc#1124805 bsc#1124806 bsc#1124824 bsc#1124825 bsc#1124826 bsc#1124827 bsc#1125099
Cross-References:	CVE-2019-7572 CVE-2019-7573 CVE-2019-7574 CVE-2019-7575 CVE-2019-7576 CVE-2019-7577 CVE-2019-7578 CVE-2019-7635 CVE-2019-7636 CVE-2019-7637 CVE-2019-7638
CVSS scores:	CVE-2019-7572 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-7572 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7572 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7573 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-7573 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7573 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7574 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-7574 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7574 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7575 ( SUSE ): 5.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2019-7575 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7575 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7576 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-7576 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7576 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7577 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-7577 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7577 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7578 ( SUSE ): 5.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2019-7578 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2019-7578 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7635 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-7635 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2019-7635 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7636 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-7636 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2019-7636 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7637 ( SUSE ): 5.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2019-7637 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7638 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-7638 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-7638 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:	SLES for SAP Applications 11-SP4 SUSE Linux Enterprise Point of Service 11 SP3 SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4

An update that solves 11 vulnerabilities can now be installed.

Description:

This update for SDL fixes the following issues:

Security issues fixed:

• CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806).
• CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099).
• CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799).
• CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805).
• CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827).
• CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826).
• CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824).
• CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803).
• CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802).
• CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825).
• CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Point of Service 11 SP3
  zypper in -t patch sleposp3-SDL-13998=1
• SUSE Linux Enterprise Software Development Kit 11 SP4
  zypper in -t patch sdksp4-SDL-13998=1
• SUSE Linux Enterprise Server 11 SP4
  zypper in -t patch slessp4-SDL-13998=1
• SLES for SAP Applications 11-SP4
  zypper in -t patch slessp4-SDL-13998=1

Package List:

• SUSE Linux Enterprise Point of Service 11 SP3 (i586)
  • SDL-1.2.13-106.11.1
• SUSE Linux Enterprise Software Development Kit 11 SP4 (s390x x86_64 i586 ppc64 ia64)
  • SDL-devel-1.2.13-106.11.1
• SUSE Linux Enterprise Software Development Kit 11 SP4 (ppc64 s390x x86_64)
  • SDL-devel-32bit-1.2.13-106.11.1
• SUSE Linux Enterprise Software Development Kit 11 SP4 (x86_64)
  • SDL-32bit-1.2.13-106.11.1
• SUSE Linux Enterprise Server 11 SP4 (s390x x86_64 i586 ppc64 ia64)
  • SDL-1.2.13-106.11.1
• SUSE Linux Enterprise Server 11 SP4 (ia64)
  • SDL-x86-1.2.13-106.11.1
• SUSE Linux Enterprise Server 11 SP4 (ppc64 s390x x86_64)
  • SDL-32bit-1.2.13-106.11.1
• SLES for SAP Applications 11-SP4 (ppc64 x86_64)
  • SDL-1.2.13-106.11.1
  • SDL-32bit-1.2.13-106.11.1

References:

• https://www.suse.com/security/cve/CVE-2019-7572.html
• https://www.suse.com/security/cve/CVE-2019-7573.html
• https://www.suse.com/security/cve/CVE-2019-7574.html
• https://www.suse.com/security/cve/CVE-2019-7575.html
• https://www.suse.com/security/cve/CVE-2019-7576.html
• https://www.suse.com/security/cve/CVE-2019-7577.html
• https://www.suse.com/security/cve/CVE-2019-7578.html
• https://www.suse.com/security/cve/CVE-2019-7635.html
• https://www.suse.com/security/cve/CVE-2019-7636.html
• https://www.suse.com/security/cve/CVE-2019-7637.html
• https://www.suse.com/security/cve/CVE-2019-7638.html
• https://bugzilla.suse.com/show_bug.cgi?id=1124799
• https://bugzilla.suse.com/show_bug.cgi?id=1124800
• https://bugzilla.suse.com/show_bug.cgi?id=1124802
• https://bugzilla.suse.com/show_bug.cgi?id=1124803
• https://bugzilla.suse.com/show_bug.cgi?id=1124805
• https://bugzilla.suse.com/show_bug.cgi?id=1124806
• https://bugzilla.suse.com/show_bug.cgi?id=1124824
• https://bugzilla.suse.com/show_bug.cgi?id=1124825
• https://bugzilla.suse.com/show_bug.cgi?id=1124826
• https://bugzilla.suse.com/show_bug.cgi?id=1124827
• https://bugzilla.suse.com/show_bug.cgi?id=1125099