Out-of-bounds Read

2023-10-2609:16:48

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

libstb.so

out-of-bounds read

vulnerability

stbi_set_flip_vertically_on_load

req_comp

memcpy

image file

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

25.9%

JSON

libstb.so is vulnerable to Out-of-bounds Read. The vulnerability is caused when stbi_set_flip_vertically_on_load is set to TRUE and req_comp is set to a number that does not match the real number of components per pixel, the library attempts to flip the image vertically. An attacker can craft an image file that can trigger memcpy out-of-bounds read because bytes_per_pixel used to calculate bytes_per_row does not match the real image array dimensions.

CPENameOperatorVersion
libstb.soeq0.0
libstb.soeq0.0
stb:3.19eq0_git20220908-r3
stb:edgeeq0_git20220908-r1
stb:edgeeq0_git20220908-r0
stb:edgeeq0_git20220908-r3