CVE-2019-7572

Name	CVE-2019-7572
Description	SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DLA-1713-1, DLA-1714-1
NVD severity	medium (attack range: remote)
Debian Bugs	924609, 924610

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libsdl1.2 (PTS)	jessie	1.2.15-10	vulnerable
	jessie (security)	1.2.15-10+deb8u1	fixed
	stretch	1.2.15+dfsg1-4	vulnerable
	sid, bullseye, buster	1.2.15+dfsg2-4	vulnerable
libsdl2 (PTS)	jessie	2.0.2+dfsg1-6	fixed
	jessie (security)	2.0.2+dfsg1-6+deb8u1	fixed
	stretch	2.0.5+dfsg1-2	vulnerable
	sid, bullseye, buster	2.0.9+dfsg1-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libsdl1.2	source	(unstable)	(unfixed)	medium		924609
libsdl1.2	source	jessie	1.2.15-10+deb8u1	medium	DLA-1713-1
libsdl2	source	(unstable)	(unfixed)	medium		924610
libsdl2	source	jessie	1.2.15-10+deb8u1	medium	DLA-1714-1

Notes

[buster] - libsdl1.2 <no-dsa> (Minor issue)
[stretch] - libsdl1.2 <no-dsa> (Minor issue)
[buster] - libsdl2 <no-dsa> (Minor issue)
[stretch] - libsdl2 <no-dsa> (Minor issue)
https://bugzilla.libsdl.org/show_bug.cgi?id=4495
Proposed patch: https://bugzilla-attachments.libsdl.org/attachment.cgi?id=3612
Proposed patch: https://bugzilla-attachments.libsdl.org/attachment.cgi?id=3618