PT-2023-29643 · Unknown+2 · Stb Vorbis+2
Jarlob
+1
·
Published
2023-10-20
·
Updated
2026-06-09
·
CVE-2023-45676
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
stb vorbis (affected versions not specified)
Description
The issue is related to the processing of ogg vorbis files. A crafted file can trigger an out of bounds write in
f->vendor[i] = get8 packet(f);. This is caused by an integer overflow in setup malloc, where a sufficiently large value in the variable sz overflows when added to 7, resulting in a negative value that passes the maximum available memory buffer check. This may lead to code execution.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Stb Vorbis