SUSE CVE-2026-5316

A vulnerability was identified in Nothings stb up to 1.22. The impacted element is the function setupfree of the file stbvorbis.c. The manipulation leads to allocation of resources. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor...

Fedora 39 : stb (2024-4c8d4cda0d)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-4c8d4cda0d advisory. Security fix for CVE-2023-45681 / CVE-2023-47212 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Fedora 40 : stb (2024-8f4d69d2ec)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-8f4d69d2ec advisory. Security fix for CVE-2023-45681 / CVE-2023-47212 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Talos discloses multiple zero-day vulnerabilities, two of which could lead to code execution

Cisco Talos Vulnerability Research team recently disclosed three zero-day vulnerabilities that are still unpatched as of Wednesday, May 8. Two vulnerabilities in this group -- one in the Tinyroxy HTTP proxy daemon and another in the stbvorbis.c file library -- could lead to arbitrary code...

CVE-2023-47212

A heap-based buffer overflow vulnerability exists in the comment functionality of stb vorbis.c v1.22. A specially crafted .ogg file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability...

stb stb_vorbis.c comment heap-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2023-1846 stb stbvorbis.c comment heap-based buffer overflow vulnerability May 1, 2024 CVE Number CVE-2023-47212 SUMMARY A heap-based buffer overflow vulnerability exists in the comment functionality of stb vorbis.c v1.22. A specially crafted .ogg file can lead to...

Double Free

libstb.so is vulnerable to Double Free. The vulnerability is due to startdecoder function in stbvorbis.c file does not initialize the memory allocated for f-commentlist. This allows an attacker to craft a file that triggers an early return in the function, leading to setupfree being called on the...

Out-of-Bounds Write

libstb.so is vulnerable to Out-of-Bounds Writes. This vulnerability exists in the f-vendorlen = char'\0' function of stbvorbis.c because it does not properly allocate memory, which allows to an attacker to perform a heap-based buffer overflow via a crafted ogg vorbis file...