CVE-2023-45677

2023-10-2100:00:00

ubuntu.com

stb_vorbis

vulnerability

ogg vorbis

out of bounds write

integer overflow

code execution

memory allocation

single file

mit licensed

unix

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

28.1%

JSON

stb_vorbis is a single file MIT licensed library for processing ogg vorbis
files. A crafted file may trigger out of bounds write in f->vendor[len] = (char)'\0';. The root cause is that if len read in start_decoder is a
negative number and setup_malloc successfully allocates memory in that
case, but memory write is done with a negative index len. Similarly if
len is INT_MAX the integer overflow len+1 happens in f->vendor = (char*)setup_malloc(f, sizeof(char) * (len+1)); and f->comment_list[i] = (char*)setup_malloc(f, sizeof(char) * (len+1));. This issue may lead to
code execution.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchlibstb< anyUNKNOWN
ubuntu22.04noarchlibstb< anyUNKNOWN
ubuntu24.04noarchlibstb< anyUNKNOWN