PT-2022-7206 · Stb+2 · Stb+2

Nbickford-Nv · Published 2022-02-17 · Updated 2022-05-10 · CVE-2022-28048

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions STB version 2.27

Description The issue is related to an integer shift of invalid size in the stbi jpeg decode block prog ac component. This can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service due to incorrect calculation.

Recommendations For STB version 2.27, consider updating to a newer version that addresses the integer shift issue in the stbi jpeg decode block prog ac component. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-682

Related Identifiers

BDU:2023-09089

CVE-2022-28048

Affected Products

Astra Linux

Debian

Stb

References · 20

• 🔥 https://github.com/nothings/stb/issues/1293 · Exploit
• https://github.com/nothings/stb/pull/1297 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-28048 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-28048 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-28048 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I4HXIWU5HBOADXZVMREHT4YTO5WVYXEQ · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-28048 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MMBCMJGAZRQS55SNECUWZSC5URVLEZ5R · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-28048 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5FXLM5XL77SNH4IPTSXOQD7XL4E2EMIN · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-09089 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-28048 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28048 · Vendor Advisory
• https://github.com/nothings/stb/commit/84b94010a7b08003cc3fb93635582849398e7ae2 · Note