CVE-2023-45661: GHSL-2023-145_GHSL-2023-151/GHSL-2023-165_GHSL-2023-172: Several memory access violations in stb_image and stb_vorbis
stbimage is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in stbigifloadnext. This happens because twoback points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory allocation information.
Other sources
stbimage.h and stbvorbis libraries contain several memory access violations of different severity.
— GitHub Security Lab
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-45661?
CVE-2023-45661 is a vulnerability in the stb_image library that allows an attacker to trigger a memory read out of bounds in the stbi__gif_load_next function.
What is the severity of CVE-2023-45661?
CVE-2023-45661 has a severity rating of 7.1 (high).
How does CVE-2023-45661 occur?
CVE-2023-45661 occurs because the two_back pointer points to a memory address lower than the start of the buffer out in the stbi__gif_load_next function.
Which software versions are affected by CVE-2023-45661?
The stb_image library versions 2.28 are affected by CVE-2023-45661.
Is there a fix for CVE-2023-45661?
Yes, a fix for CVE-2023-45661 is available. Please refer to the provided references for more information.