CVE-2019-12216

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a heap-based buffer overflow in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.libsdl.org/show_bug.cgi?id=4619Exploit, Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/07/msg00021.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/07/msg00026.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6FDFPYUJ7YPY3XB5U75VJHBSVRVIKO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJ2VRD57UOBT72JUC2DIFHEFCH4N64SW/
https://usn.ubuntu.com/4238-1/Third Party Advisory
https://bugzilla.libsdl.org/show_bug.cgi?id=4619Exploit, Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/07/msg00021.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/07/msg00026.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6FDFPYUJ7YPY3XB5U75VJHBSVRVIKO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJ2VRD57UOBT72JUC2DIFHEFCH4N64SW/
https://usn.ubuntu.com/4238-1/Third Party Advisory

Timeline

Published: May 20, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-122176.5An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0 CVE-2019-122186.5An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0 CVE-2019-122198.8An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0 CVE-2019-12229.8A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated atta CVE-2019-122206.5An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0 CVE-2019-122216.5An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0 CVE-2019-122226.5An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the function SDL_InvalidateM CVE-2019-122237.5An issue was discovered in NVR WebViewer on Hanwah Techwin SRN-472s 1.07_190502 devices, and other SRN-x devices before 2019-05-03. A system CVE-2019-12237.5A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends CVE-2019-122397.2The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that r CVE-2019-12247.5An information disclosure vulnerability exists when the Windows RDP server improperly discloses the contents of its memory. An attacker who CVE-2019-122409.8The Virim plugin 0.4 for WordPress allows Insecure Deserialization via s_values, t_values, or c_values in graph.php.