stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free the out variable. This happens in `stbi__load_gif_main` because when the `layers * stride` value is zero the behavior is implementation defined, but common that realloc frees the old memory and returns null pointer. Since it attempts to double-free the memory a few lines below the first “free”, the issue can be potentially exploited only in a multi-threaded environment. In the worst case this may lead to code execution.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger     `stbi__load_gif_main_outofmem` attempt to double-free the out variable. This happens in     `stbi__load_gif_main` because when the `layers * stride` value is zero the behavior is implementation     defined, but common that realloc frees the old memory and returns null pointer. Since it attempts to     double-free the memory a few lines below the first free, the issue can be potentially exploited only in     a multi-threaded environment. In the worst case this may lead to code execution. (CVE-2023-45664)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-58af3a2eca advisory.

    Security fix for CVE-2023-45661 CVE-2023-45662 CVE-2023-45663 CVE-2023-45664 CVE-2023-45666 CVE-2023-45667     CVE-2023-45675

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-def2f95af4 advisory.

    Security fix for CVE-2023-45661 CVE-2023-45662 CVE-2023-45663 CVE-2023-45664 CVE-2023-45666 CVE-2023-45667     CVE-2023-45675 CVE-2023-43281

    ----

    A new parallel-installable stb_image_resize2 library is added (stb_image_resize2-devel). It should provide     significantly better performance; the API is similar but not compatible. The original stb_image_resize     library is deprecated by the author, but will continue to be packaged as stb_image_resize-devel for the     foreseeable future.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-d486d13cfd advisory.

    Security fix for CVE-2023-45661 CVE-2023-45662 CVE-2023-45663 CVE-2023-45664 CVE-2023-45666 CVE-2023-45667     CVE-2023-45675 CVE-2023-43281

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-a93c06a1d9 advisory.

    Security fix for CVE-2023-45661 CVE-2023-45662 CVE-2023-45663 CVE-2023-45664 CVE-2023-45666 CVE-2023-45667     CVE-2023-45675 CVE-2023-43281

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
232171	Linux Distros Unpatched Vulnerability : CVE-2023-45664	Nessus	Misc.	high
194602	Fedora 40 : stb / usd (2023-58af3a2eca)	Nessus	Fedora Local Security Checks	critical
185272	Fedora 39 : stb / usd (2023-def2f95af4)	Nessus	Fedora Local Security Checks	critical
184401	Fedora 38 : stb / usd (2023-d486d13cfd)	Nessus	Fedora Local Security Checks	critical
184397	Fedora 37 : stb / usd (2023-a93c06a1d9)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2023-45664

high

Tenable Plugins

high

critical

critical

critical

critical