A heap-based buffer overflow vulnerability exists in the comment functionality of stb vorbis.c v1.22. A specially crafted .ogg file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.

stbimage is a single file MIT licensed library for processing images. It may look like stbiloadgifmain doesn’t give guarantees about the content of output value delays upon failure. Although it sets delays to zero at the beginning, it doesn’t do it in case the image is not recognized as GIF and a call to stbiloadgifmainoutofmem only frees possibly allocated memory in delays without resetting it to zero. Thus it would be fair to say the caller of stbiloadgifmain is responsible to free the allocated memory in delays only if stbiloadgifmain returns a non null value. However at the same time the function may return null value, but fail to free the memory in delays if internally stbiconvertformat is called and fails. Thus the issue may lead to a memory leak if the caller chooses to free delays only when stbiloadgifmain didn’t fail or to a double-free if the delays is always freed

stbimage is a single file MIT licensed library for processing images. A crafted image file can trigger stbiloadgifmainoutofmem attempt to double-free the out variable. This happens in stbiloadgifmain because when the layers stride value is zero the behavior is implementation defined, but common that realloc frees the old memory and returns null pointer. Since it attempts to double-free the memory a few lines below the first “free”, the issue can be potentially exploited only in a multi-threaded environment. In the worst case this may lead to code execution.

stb stbtruetype.h through 1.22 has an assertion failure in stbttbufseek.

stb stbtruetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT.

stb stbtruetype.h through 1.22 has a heap-based buffer over-read in stbttfindtable.

stb stbtruetype.h through 1.22 has an assertion failure in stbttcffgetindex.

stb stbtruetype.h through 1.22 has an assertion failure in stbttcffint.

stb stbtruetype.h through 1.22 has a heap-based buffer over-read in stbttbufget8.

stb stbtruetype.h through 1.22 has a heap-based buffer over-read in stbttbufpeek8.

stbimage.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbiloadmain.

stb stbimage.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbioutgifcode function.

stbimage.h v2.27 was discovered to contain an heap-based use-after-free via the function stbijpeghuffdecode.

stbimage is a single file MIT licensed library for processing images. When stbisetflipverticallyonload is set to TRUE and reqcomp is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. A crafted image file can trigger memcpy out-of-bounds read because bytesperpixel used to calculate bytesperrow doesn’t match the real image array dimensions.

stbimage.h and stbvorbis libraries contain several memory access violations of different severity.

stbimage.h and stbvorbis libraries contain several memory access violations of different severity.

stbimage.h and stbvorbis libraries contain several memory access violations of different severity.

stbimage.h and stbvorbis libraries contain several memory access violations of different severity.

stbimage.h and stbvorbis libraries contain several memory access violations of different severity.

stbimage.h and stbvorbis libraries contain several memory access violations of different severity.

stbimage is a single file MIT licensed library for processing images.

If stbiloadgifmain in stbiloadgiffrommemory fails it returns a null pointer and may keep the z variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls stbiverticalflipslices with the null pointer result value and the uninitialized z value. This may result in a program crash.

DISPUTED stbtruetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stbtruetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbttGetGlyphShapeTT() function within the nothings stbtruetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path. An attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stbtruetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbttGetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read.

stbimage is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in stbigifloadnext. This happens because twoback points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory allocation information.

stbimage.h and stbvorbis libraries contain several memory access violations of different severity.

An issue was discovered in stb stbimage.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when converting to RGBA, leading to a buffer overflow when later reinterpreting the result as a 16-bit buffer. An attacker could potentially have crashed a service using stbimage, or read up to 1024 bytes of non-consecutive heap data without control over the read location.

stbimage.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbishiftsigned.

DISPUTED stbtruetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttULONG() at stbtruetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.

DISPUTED stbtruetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbttfindtable at stbtruetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.

stbimage.h v2.27 was discovered to contain an integer overflow via the function stbijpegdecodeblockprogdc. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.