CVE-2023-45679: GHSL-2023-145_GHSL-2023-151/GHSL-2023-165_GHSL-2023-172: Several memory access violations in stb_image and stb_vorbis
stbimage.h and stbvorbis libraries contain several memory access violations of different severity.
Other sources
stbvorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in startdecoder. In that case the function returns early, but some of the pointers in f->commentlist are left initialized and later setupfree is called on these pointers in vorbisdeinit. This issue may lead to code execution.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-45679?
CVE-2023-45679 is a vulnerability in the stb_vorbis library that allows a crafted file to trigger memory allocation failure and lead to uninitialized memory pointers.
How severe is CVE-2023-45679?
CVE-2023-45679 has a severity rating of 7.3 (high).
What software versions are affected by CVE-2023-45679?
The affected version of the stb_vorbis library is 1.22.
How can I fix CVE-2023-45679?
There is currently no patch available for CVE-2023-45679. It is recommended to update to the latest version once a patch is released.
What is the Common Weakness Enumeration (CWE) ID for CVE-2023-45679?
The CWE ID for CVE-2023-45679 is CWE-415.