Vulnerability · Published Apr 1, 2022 · Assigned by openEuler
CVE-2021-33657
High 8.8
In plain English
A high-severity security flaw in SDL2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)8.8High
Exploit odds (30 days)2.1%top 18.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18 versions. By crafting a malicious .BMP file, an attacker can cause the application using this library to crash, denial of service or Code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | sdl2 | 2.0.18-r0 | ALPINE-CVE-2021-33657 |
| Alpine:v3.21 | sdl2 | 2.0.18-r0 | ALPINE-CVE-2021-33657 |
| Alpine:v3.22 | sdl2 | 2.0.18-r0 | ALPINE-CVE-2021-33657 |
| Alpine:v3.23 | sdl2 | 2.0.18-r0 | ALPINE-CVE-2021-33657 |
| Alpine:v3.24 | sdl2 | 2.0.18-r0 | ALPINE-CVE-2021-33657 |
| Debian:12 | libsdl1.2 | 1.2.15+dfsg2-7 | DEBIAN-CVE-2021-33657 |
| Debian:12 | libsdl2 | 2.0.20+dfsg-2 | DEBIAN-CVE-2021-33657 |
| Debian:13 | libsdl2 | 2.0.20+dfsg-2 | DEBIAN-CVE-2021-33657 |
| Debian:14 | libsdl2 | 2.0.20+dfsg-2 | DEBIAN-CVE-2021-33657 |
| Ubuntu:22.04:LTS | libsdl1.2 | no fix listed | UBUNTU-CVE-2021-33657 |