CVE-2023-45675mediumCWE-787

CVE-2023-45675: falha de média gravidade em nothings stb

0 byte write heap buffer overflow in start_decoder in stb_vorbis

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar stb+ Monitorar libstb

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.7%
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if the len read in `start_decoder` is `-1` and `len + 1` becomes 0 when passed to `setup_malloc`. The `setup_malloc` behaves differently when `f->alloc.alloc_buffer` is pre-allocated. Instead of returning `NULL` as in `malloc` case it shifts the pre-allocated buffer by zero and returns the currently available memory block. This issue may lead to code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Produtos afetados
nothings · stb
CVEs relacionadas — nothings stb

No mesmo produto, das mais perigosas para as menos.

CVE-2023-45667MEDIUMNull pointer dereference because of an uninitialized variable in stb_imageEPSS 1.3%CVE-2023-45666HIGHPossible double-free or memory leak in stbi__load_gif_main in stb_imageEPSS 1.1%CVE-2023-45664HIGHDouble-free in stbi__load_gif_main_outofmem in stb_imageEPSS 0.9%CVE-2023-45662MEDIUMMulti-byte read heap buffer overflow in stbi__vertical_flip in stb_imageEPSS 0.8%CVE-2023-45678MEDIUMOff-by-one heap buffer write in start_decoder in stb_vorbisEPSS 0.7%CVE-2023-45663MEDIUMDisclosure of uninitialized memory in stbi__tga_load in stb_imageEPSS 0.7%