CVE-2023-45682

CVSS V2 None CVSS V3 None

Description

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds read in `DECODE` macro when `var` is negative. As it can be seen in the definition of `DECODE_RAW` a negative `var` is a valid value. This issue may be used to leak internal memory allocation information.

Overview

CVE ID
CVE-2023-45682

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2023-10-20T23:27:04.879Z

Last Modified Date
2023-10-20T23:27:04.879Z

Weakness Enumerations

CWE	URL
CWE-125	http://cwe.mitre.org/data/definitions/125.html

References

Reference URL	Reference Tags
https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/	x_refsource_CONFIRM
https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L1717-L1729	x_refsource_MISC
https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L1754-L1756	x_refsource_MISC
https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L3231	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-45682
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45682

History

Created	Old Value	New Value	Data Type	Notes
2024-06-25 10:21:20				Added to TrackCVE