SUSE CVE-2023-45677

stbvorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in f-vendorlen = char'\0';. The root cause is that if len read in startdecoder is a negative number and setupmalloc successfully allocates memory in that case, but memor...

SUSE CVE-2023-45676

stbvorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in f-vendori = get8packetf;. The root cause is an integer overflow in setupmalloc. A sufficiently large value in the variable sz overflows with sz+7 in and the negative...

SUSE CVE-2023-45682

stbvorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds read in DECODE macro when var is negative. As it can be seen in the definition of DECODERAW a negative var is a valid value. This issue may be used to leak internal memory...

SUSE CVE-2023-45681

stbvorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in startdecoder. The root cause is a potential integer overflow in sizeofchar f-commentlistlength which may make setupmalloc allocate less memory...

SUSE CVE-2023-45679

stbvorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in startdecoder. In that case the function returns early, but some of the pointers in f-commentlist are left initialized and later setupfree is called on these...

CVE-2023-43281: Double Free

Double Free vulnerability in Nothings Stb Image.h v.2.28 allows a remote attacker to cause a denial of service via a crafted file to the stbiloadgifmain function...

CVE-2023-43281

CVE-2023-43281 describes a double free vulnerability in Nothings Stb Image.h v2.28. The flaw allows a remote attacker to cause a denial of service by supplying a crafted file to the function stbi_load_gif_main . Public documentation in the connected sources confirms the vulnerability in the stb_i...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read when the stbisetflipverticallyonload is set to TRUE and reqcomp is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. An attacker can trigger...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read due to the stbigifloadnext function. An attacker can leak internal memory allocation information by triggering an out of bounds memcpy read with a crafted image file. This happens because twoback points to a memory...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the f-vendorlen = char'\0'; function. An attacker can trigger an out-of-bounds write and potentially execute arbitrary code by providing a crafted file. This is only exploitable if len read in startdecoder is a...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the startdecoder function. An attacker can trigger an out-of-buffer write and potentially execute arbitrary code by providing a specially crafted file. This is only exploitable if m-submaps exceeds the array limit...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the startdecoder function, an attacker can execute arbitrary code by exploiting an integer overflow that leads to memory write past an allocated heap buffer. This is due to the potential integer overflow in...

Out-of-Bounds Write

Overview Affected versions of this package are vulnerable to Out-of-Bounds Write in the f-vendori = get8packetf; function. An attacker can trigger an out-of-bounds write and potentially execute arbitrary code by providing a crafted file. This is due to an integer overflow in setupmalloc where a...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource in the stbihdrload and stbitgaload functions. An attacker can read a specified number of bytes from context into an uninitialized buffer by manipulating the file stream to point to the end. This is only...

Double Free

Overview Affected versions of this package are vulnerable to Double Free in the startdecoder function, an attacker can trigger memory allocation failure with a specially crafted file. This causes the function to return early, leaving some pointers in f-commentlist initialized. Later, setupfree is...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference when the stbiloadgifmain in stbiloadgiffrommemory fails, it returns a null pointer and may leave the z variable uninitialized. If the caller also sets the flip vertically flag, it continues and calls...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write when processing ogg vorbis files with the f-vendorlen = char'\0'; function. An attacker can trigger an out-of-bounds write by crafting a file that causes the len read in startdecoder to be -1, and len + 1 to become 0...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference when the startdecoder function processes a specially crafted file, it may trigger a memory allocation failure. An attacker can cause a denial of service by exploiting this failure. This is because the function...

DEBIAN-CVE-2023-45677

stbvorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in f-vendorlen = char'\0';. The root cause is that if len read in startdecoder is a negative number and setupmalloc successfully allocates memory in that case, but memor...

DEBIAN-CVE-2023-45676

stbvorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in f-vendori = get8packetf;. The root cause is an integer overflow in setupmalloc. A sufficiently large value in the variable sz overflows with sz+7 in and the negative...