PT-2023-29636 · Stb Image+3 · Stb Image+3

Jarlob + 1 · Published 2023-10-20 · Updated 2024-09-13 · CVE-2023-45663

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions stb image (affected versions not specified)

Description The issue is related to the stbi getn function in the stb image library, which reads a specified number of bytes from a context into a buffer. If the file stream points to the end, it returns zero. However, there are two places where its return value is not checked: in the stbi hdr load function and in the stbi tga load function. The latter is likely more exploitable as an attacker may also control the size of an uninitialized buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

ALT-PU-2023-7362

ALT-PU-2024-11393

CVE-2023-45663

OESA-2024-1230

OESA-2024-1231

Affected Products

Alt Linux

Astra Linux

Debian

Stb Image

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45663.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-45663 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1231 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NMXKOKPP4BKTNUTF5KSRDQAWOUILQZNO · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-45663 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45662 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-45663 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QVABVF4GEM6BYD5L4L64RCRSXUHY6LGN · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1230 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45663 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UVQ7ONFH5GWLMXYEAJG32A3EUKUCEVCR · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-45663 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-45663 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45663 · Vendor Advisory
• https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_image.h#L5936C10-L5936C20 · Note