CVE-2023-45663: GHSL-2023-145_GHSL-2023-151/GHSL-2023-165_GHSL-2023-172: Several memory access violations in stb_image and stb_vorbis
stbimage is a single file MIT licensed library for processing images. The stbigetn function reads a specified number of bytes from context (typically a file) into the specified buffer. In case the file stream points to the end, it returns zero. There are two places where its return value is not checked: In the stbihdrload function and in the stbitgaload function. The latter of the two is likely more exploitable as an attacker may also control the size of an uninitialized buffer.
Other sources
stbimage.h and stbvorbis libraries contain several memory access violations of different severity.
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-45663?
CVE-2023-45663 refers to a vulnerability in the stb_image library that allows for the disclosure of uninitialized memory when processing TGA image files.
What is the severity of CVE-2023-45663?
CVE-2023-45663 has a severity rating of 5.3, which is considered medium.
What software is affected by CVE-2023-45663?
The Nothings Stb Image.h library version 2.28 is affected by CVE-2023-45663.
How does CVE-2023-45663 affect the stb_image library?
CVE-2023-45663 affects the stb_image library by allowing an attacker to access uninitialized memory when processing certain TGA image files.
Is there a fix for CVE-2023-45663?
Yes, the fix for CVE-2023-45663 is available in the latest version of the stb_image library. It is recommended to update to the latest version to mitigate the vulnerability.