CVE-2023-45680

2023-10-2100:15:09

CWE-476

GitHub_M

web.nvd.nist.gov

stb_vorbis

library

cve-2023-45680

memory allocation failure

start_decoder

denial of service

nvd

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

5.2

Confidence

High

EPSS

Percentile

10.1%

JSON

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in start_decoder. In that case the function returns early, the f->comment_list is set to NULL, but f->comment_list_length is not reset. Later in vorbis_deinit it tries to dereference the NULL pointer. This issue may lead to denial of service.

Affected configurations

Nvd

Vulners

Node

nothingsstb_vorbis.cMatch1.22

VendorProductVersionCPE
nothingsstb_image\.h*cpe:2.3:a:nothings:stb_image\.h:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nothings	stb_image\.h	*	cpe:2.3:a:nothings:stb_image\.h::::::::

CNA Affected

[
  {
    "vendor": "nothings",
    "product": "stb",
    "versions": [
      {
        "version": "<= 1.22",
        "status": "affected"
      }
    ]
  }
]