CVE-2023-45676: GHSL-2023-145_GHSL-2023-151/GHSL-2023-165_GHSL-2023-172: Several memory access violations in stb_image and stb_vorbis
stbimage.h and stbvorbis libraries contain several memory access violations of different severity.
Other sources
stbvorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in f->vendor[i] = get8packet(f);. The root cause is an integer overflow in setupmalloc. A sufficiently large value in the variable sz overflows with sz+7 in and the negative value passes the maximum available memory buffer check. This issue may lead to code execution.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2023-45676.
What is the severity of CVE-2023-45676?
The severity of CVE-2023-45676 is high with a severity value of 7.3.
Which software is affected by CVE-2023-45676?
The software affected by CVE-2023-45676 is stb_vorbis version 1.22.
What is the root cause of CVE-2023-45676?
The root cause of CVE-2023-45676 is an integer overflow in the `setup_malloc` function.
How can CVE-2023-45676 be fixed?
To fix CVE-2023-45676, it is recommended to update to a patched version of stb_vorbis.