stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if the len read in `start_decoder` is `-1` and `len + 1` becomes 0 when passed to `setup_malloc`. The `setup_malloc` behaves differently when `f->alloc.alloc_buffer` is pre-allocated. Instead of returning `NULL` as in `malloc` case it shifts the pre-allocated buffer by zero and returns the currently available memory block. This issue may lead to code execution.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if the len read in     `start_decoder` is `-1` and `len + 1` becomes 0 when passed to `setup_malloc`. The `setup_malloc` behaves     differently when `f->alloc.alloc_buffer` is pre-allocated. Instead of returning `NULL` as in `malloc` case     it shifts the pre-allocated buffer by zero and returns the currently available memory block. This issue     may lead to code execution. (CVE-2023-45675)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-58af3a2eca advisory.

    Security fix for CVE-2023-45661 CVE-2023-45662 CVE-2023-45663 CVE-2023-45664 CVE-2023-45666 CVE-2023-45667     CVE-2023-45675

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - stb_image is a single file MIT licensed library for processing images. It may look like
    `stbi__load_gif_main` doesn’t give guarantees about the content of output value `*delays` upon failure.
    Although it sets `*delays` to zero at the beginning, it doesn’t do it in case the image is not recognized
    as GIF and a call to `stbi__load_gif_main_outofmem` only frees possibly allocated memory in `*delays`
    without resetting it to zero. Thus it would be fair to say the caller of `stbi__load_gif_main` is
    responsible to free the allocated memory in `*delays` only if `stbi__load_gif_main` returns a non null
    value. However at the same time the function may return null value, but fail to free the memory in
    `*delays` if internally `stbi__convert_format` is called and fails. Thus the issue may lead to a memory
    leak if the caller chooses to free `delays` only when `stbi__load_gif_main` didn’t fail or to a double-
    free if the `delays` is always freed (CVE-2023-45666)

  - Nothings stb 2.28 was discovered to contain a Null Pointer Dereference via the function
    stbi__convert_format. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted
    pic file. (CVE-2023-43898)

  - stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger
    out of bounds memcpy read in `stbi__gif_load_next`. This happens because two_back points to a memory
    address lower than the start of the buffer out. This issue may be used to leak internal memory allocation
    information. (CVE-2023-45661)

  - stb_image is a single file MIT licensed library for processing images. When
    `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_comp` is set to a number that doesn’t match
    the real number of components per pixel, the library attempts to flip the image vertically. A crafted
    image file can trigger `memcpy` out-of-bounds read because `bytes_per_pixel` used to calculate
    `bytes_per_row` doesn’t match the real image array dimensions. (CVE-2023-45662)

  - stb_image is a single file MIT licensed library for processing images. The stbi__getn function reads a
    specified number of bytes from context (typically a file) into the specified buffer. In case the file
    stream points to the end, it returns zero. There are two places where its return value is not checked: In
    the `stbi__hdr_load` function and in the `stbi__tga_load` function. The latter of the two is likely more
    exploitable as an attacker may also control the size of an uninitialized buffer. (CVE-2023-45663)

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-def2f95af4 advisory.

    Security fix for CVE-2023-45661 CVE-2023-45662 CVE-2023-45663 CVE-2023-45664 CVE-2023-45666 CVE-2023-45667     CVE-2023-45675 CVE-2023-43281

    ----

    A new parallel-installable stb_image_resize2 library is added (stb_image_resize2-devel). It should provide     significantly better performance; the API is similar but not compatible. The original stb_image_resize     library is deprecated by the author, but will continue to be packaged as stb_image_resize-devel for the     foreseeable future.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-d486d13cfd advisory.

    Security fix for CVE-2023-45661 CVE-2023-45662 CVE-2023-45663 CVE-2023-45664 CVE-2023-45666 CVE-2023-45667     CVE-2023-45675 CVE-2023-43281

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-a93c06a1d9 advisory.

    Security fix for CVE-2023-45661 CVE-2023-45662 CVE-2023-45663 CVE-2023-45664 CVE-2023-45666 CVE-2023-45667     CVE-2023-45675 CVE-2023-43281

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
232159	Linux Distros Unpatched Vulnerability : CVE-2023-45675	Nessus	Misc.	high
194602	Fedora 40 : stb / usd (2023-58af3a2eca)	Nessus	Fedora Local Security Checks	critical
408136	Alpine: multiple stb packages: security update to 0_git20231012-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
408136	Alpine: multiple stb packages: security update to 0_git20231012-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
185272	Fedora 39 : stb / usd (2023-def2f95af4)	Nessus	Fedora Local Security Checks	critical
184401	Fedora 38 : stb / usd (2023-d486d13cfd)	Nessus	Fedora Local Security Checks	critical
184397	Fedora 37 : stb / usd (2023-a93c06a1d9)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2023-45675

high

Tenable Plugins

high

critical

critical

critical

critical

critical

critical