Lucene search

Veracode Vulnerability DatabaseVERACODE:44011

HistoryOct 26, 2023 - 9:33 a.m.

Out-of-bounds Write

2023-10-2609:33:44

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

libstb.so

out-of-bounds write

start_decoder

submaps

submap_floor

submap_residue

memory

crafted file

vulnerability

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.7%

JSON

libstb.so is vulnerable to Out-of-bounds Write. The vulnerability is due to start_decoder functions maximum number of submaps allowed is 16, but submap_floor and submap_residue are declared as arrays of 15 elements. This allows an attacker can causes an out-of-bounds write in memory with a crafted file.

CPENameOperatorVersion
libstb.soeq0.0
libstb.soeq0.0

CPE	Name	Operator	Version
	libstb.so	eq	0.0
	libstb.so	eq	0.0

References

github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L4074-L4079

github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L753-L760

github.com/nothings/stb/pull/1556

github.com/nothings/stb/pull/1556/commits/5385fb37a9f71eac14f95a01582a7388fce52838

securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/

securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/#issue-11-off-by-one-heap-buffer-write-in-start_decoder-ghsl-2023-168

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.7%

JSON

Related for VERACODE:44011