CVE-2020-14409

HIGH 7.8CVE-2020-14409 · Published 19/01/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
simple directmedia layer libsdl	`≥ 2.0.12, ≤ 2.0.20`	No fix yet
starwind virtual san starwindsoftware	`= v8`	No fix yet

Description

SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SDL_blit_copy.c via a crafted .BMP file.

References

bugzilla.libsdl.org/show_bug.cgi · Issue Tracking
hg.libsdl.org/SDL/rev/3f9b4e92c1d9 · Patch
lists.debian.org/debian-lts-announce/2021/01/msg00024.html · Mailing List
lists.debian.org/debian-lts-announce/2023/02/msg00008.html · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5FS32YCEJLQ2FYUWSWYI2ZMQWQEAWJNR · Mailing List
security.gentoo.org/glsa/202107-55 · Third Party Advisory
starwindsoftware.com/security/sw-20210325-0001 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free