CVE-2023-45680: GHSL-2023-145_GHSL-2023-151/GHSL-2023-165_GHSL-2023-172: Several memory access violations in stb_image and stb_vorbis
stbimage.h and stbvorbis libraries contain several memory access violations of different severity.
Other sources
stbvorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in startdecoder. In that case the function returns early, the f->commentlist is set to NULL, but f->commentlistlength is not reset. Later in vorbisdeinit it tries to dereference the NULL pointer. This issue may lead to denial of service.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-45680?
CVE-2023-45680 is a vulnerability in the stb_vorbis library that can lead to a null pointer dereference in the vorbis_deinit function.
What is the severity level of CVE-2023-45680?
The severity level of CVE-2023-45680 is medium with a CVSS score of 5.3.
How does CVE-2023-45680 affect software?
CVE-2023-45680 affects software that uses the stb_vorbis library version 1.22.
How can I fix CVE-2023-45680?
To fix CVE-2023-45680, update the stb_vorbis library to a version that has addressed the vulnerability.
What is CWE-476?
CWE-476 is a category of vulnerabilities that includes null pointer dereference vulnerabilities.