Vulnerabilities > CVE-2022-27470 - Out-of-bounds Write vulnerability in multiple products

CVSS 7.8 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

local

low complexity

libsdl

fedoraproject

CWE-787

NVD

Published: 2022-05-04

Updated: 2023-11-07

Summary

SDL_ttf v2.0.18 and below was discovered to contain an arbitrary memory write via the function TTF_RenderText_Solid(). This vulnerability is triggered via a crafted TTF file.

Vulnerable Configurations

Part	Description	Count
Application	Libsdl Libsdl SDL TTF 2.0.8 Libsdl SDL TTF 2.0.9 Libsdl SDL TTF 2.0.10 Libsdl SDL TTF 2.0.11 Libsdl SDL TTF 2.0.12 Libsdl SDL TTF 2.0.13 Libsdl SDL TTF 2.0.14 Libsdl SDL TTF 2.0.15 Libsdl SDL TTF 2.0.18	9
OS	Fedoraproject Fedoraproject Fedora 34 Fedoraproject Fedora 35 Fedoraproject Fedora 36	3

Common Weakness Enumeration (CWE)

CWE-787 - Out-of-bounds Write

References

https://github.com/libsdl-org/SDL_ttf/commit/db1b41ab8bde6723c24b866e466cad78c2fa0448
https://github.com/libsdl-org/SDL_ttf/issues/187
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPYTEBBNHCDGPVFACC5RC5K2FZUCYTPZ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAGMQMRQDTZFQW64JEW3O6HY3JYLAAHT/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RXI3MDPR24W5557G34YHWOP2MOK6BTGB/