CVE-2023-45663

2023-10-2100:00:00

ubuntu.com

stb_image

mit

buffer reading

stbi__hdr_load

stbi__tga_load

file stream

uninitialized buffer

exploitable

security vulnerability

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

23.8%

JSON

stb_image is a single file MIT licensed library for processing images. The
stbi__getn function reads a specified number of bytes from context
(typically a file) into the specified buffer. In case the file stream
points to the end, it returns zero. There are two places where its return
value is not checked: In the stbi__hdr_load function and in the
stbi__tga_load function. The latter of the two is likely more exploitable
as an attacker may also control the size of an uninitialized buffer.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchlibstb< anyUNKNOWN
ubuntu22.04noarchlibstb< anyUNKNOWN
ubuntu23.10noarchlibstb< anyUNKNOWN
ubuntu24.04noarchlibstb< anyUNKNOWN