CVE-2019-5060

Name of the Vulnerable Software and Affected Versions SDL2 image version 2.0.4

Description A code execution issue exists in the XPM image rendering function. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this issue.

Recommendations For version 2.0.4, consider disabling the XPM image rendering function until a patch is available. Restrict access to the colorhash function to minimize the risk of exploitation. Avoid using the XPM image format in the affected function until the issue is resolved.