PT-2023-9365 · Stb Image+3 · Stb Image+3

Jarlob + 1 · Published 2023-07-13 · Updated 2024-09-13 · CVE-2023-45662

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions stb image (affected versions not specified)

Description The issue is related to the stbi set flip vertically on load function in the stb image library. When this function is set to TRUE and req comp is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. This can trigger an out-of-bounds read in memcpy because bytes per pixel used to calculate bytes per row doesn’t match the real image array dimensions. A crafted image file can exploit this, potentially allowing a remote attacker to access confidential data or cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2023-7362

ALT-PU-2024-11393

BDU:2024-06920

CVE-2023-45662

OESA-2024-1230

OESA-2024-1231

Affected Products

Alt Linux

Astra Linux

Debian

Stb Image

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45662.json · Exploit
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NMXKOKPP4BKTNUTF5KSRDQAWOUILQZNO · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1231 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45662 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QVABVF4GEM6BYD5L4L64RCRSXUHY6LGN · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1230 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-45662 · Security Note
• https://bdu.fstec.ru/vul/2024-06920 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UVQ7ONFH5GWLMXYEAJG32A3EUKUCEVCR · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-45662 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-45662 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-45662 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-45662 · Vendor Advisory