CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
26.9%
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in start_decoder
. The root cause is a potential integer overflow in sizeof(char*) * (f->comment_list_length)
which may make setup_malloc
allocate less memory than required. Since there is another integer overflow an attacker may overflow it too to force setup_malloc
to return 0 and make the exploit more reliable. This issue may lead to code execution.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Mageia | 9 | noarch | stb | < 0-0.git20230129.4.1 | stb-0-0.git20230129.4.1.mga9 |