CVE-2020-14410

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP file.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.libsdl.org/show_bug.cgi?id=5200Issue Tracking, Vendor Advisory
https://hg.libsdl.org/SDL/rev/3f9b4e92c1d9Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/01/msg00024.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/02/msg00008.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5FS32YCEJLQ2FYUWSWYI2ZMQWQEAWJNR/Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202107-55Third Party Advisory
https://bugzilla.libsdl.org/show_bug.cgi?id=5200Issue Tracking, Vendor Advisory
https://hg.libsdl.org/SDL/rev/3f9b4e92c1d9Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/01/msg00024.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/02/msg00008.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5FS32YCEJLQ2FYUWSWYI2ZMQWQEAWJNR/Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202107-55Third Party Advisory

Timeline

Published: Jan 19, 2021
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-144128.8NeDi 1.9C is vulnerable to Remote Command Execution. System-Snapshot.php improperly escapes shell metacharacters from a POST request. An att CVE-2020-144136.1NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function attempts to escape the CVE-2020-144148.8NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a POST request. An attacker can CVE-2020-144153.3oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position.CVE-2020-144164.2In the Linux kernel before 5.4.16, a race condition in tty->disc_data handling in the slip and slcan line discipline could lead to a use-aft CVE-2020-144187.0A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occur CVE-2020-14426.1A spoofing vulnerability exists when an Office Web Apps server does not properly sanitize a specially crafted request, aka 'Office Web Apps CVE-2020-144217.2aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via the Script Content box on the Add Cron Job screen.CVE-2020-144225.9Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a CVE-2020-144235.3Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOS_LOCAL_SECR CVE-2020-144246.1Cacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter theme.CVE-2020-144257.8Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and