CVE-2023-45678: GHSL-2023-145_GHSL-2023-151/GHSL-2023-165_GHSL-2023-172: Several memory access violations in stb_image and stb_vorbis
stbimage.h and stbvorbis libraries contain several memory access violations of different severity.
Other sources
stbvorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in startdecoder because at maximum m->submaps can be 16 but submapfloor and submapresidue are declared as arrays of 15 elements. This issue may lead to code execution.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-45678.
What is the severity of CVE-2023-45678?
The severity of CVE-2023-45678 is high with a CVSS score of 7.8.
What software is affected by CVE-2023-45678?
The affected software is stb_vorbis version 1.22.
What is the root cause of CVE-2023-45678?
The root cause of CVE-2023-45678 is an off-by-one heap buffer write in the start_decoder function of stb_vorbis.c.
How can I fix CVE-2023-45678?
To fix CVE-2023-45678, update to a version of stb_vorbis that addresses the buffer write issue.