Описание
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in f->vendor[i] = get8_packet(f);. The root cause is an integer overflow in setup_malloc. A sufficiently large value in the variable sz overflows with sz+7 in and the negative value passes the maximum available memory buffer check. This issue may lead to code execution.
Ссылки
- Third Party Advisory
- https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L950-L960Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L950-L960Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
EPSS
7.3 High
CVSS3
7.8 High
CVSS3
Дефекты
Связанные уязвимости
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[i] = get8_packet(f);`. The root cause is an integer overflow in `setup_malloc`. A sufficiently large value in the variable `sz` overflows with `sz+7` in and the negative value passes the maximum available memory buffer check. This issue may lead to code execution.
stb_vorbis is a single file MIT licensed library for processing ogg vo ...
Уязвимость библиотек для C/C++ Libstb, связанная с записью за границами буфера, позволяющая нарушителю получить доступ к защищаемой информации
EPSS
7.3 High
CVSS3
7.8 High
CVSS3