Vulnerability · Published Oct 20, 2023 · Assigned by GitHub_M
CVE-2023-45663Disclosure of uninitialized memory in stbi__tga_load in stb_image
Medium 5.3
In plain English
A medium-severity security flaw in stb from nothings. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
stb_image is a single file MIT licensed library for processing images. The stbi__getn function reads a specified number of bytes from context (typically a file) into the specified buffer. In case the file stream points to the end, it returns zero. There are two places where its return value is not checked: In the `stbi__hdr_load` function and in the `stbi__tga_load` function. The latter of the two is likely more exploitable as an attacker may also control the size of an uninitialized buffer.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | stb | 0_git20231012-r0 | ALPINE-CVE-2023-45663 |
| Alpine:v3.21 | stb | 0_git20231012-r0 | ALPINE-CVE-2023-45663 |
| Alpine:v3.22 | stb | 0_git20231012-r0 | ALPINE-CVE-2023-45663 |
| Alpine:v3.23 | stb | 0_git20231012-r0 | ALPINE-CVE-2023-45663 |
| Alpine:v3.24 | stb | 0_git20231012-r0 | ALPINE-CVE-2023-45663 |
| Debian:12 | libstb | no fix listed | DEBIAN-CVE-2023-45663 |
| Debian:13 | libstb | no fix listed | DEBIAN-CVE-2023-45663 |
| Debian:14 | libstb | no fix listed | DEBIAN-CVE-2023-45663 |
| Ubuntu:22.04:LTS | libstb | no fix listed | UBUNTU-CVE-2023-45663 |
| Ubuntu:24.04:LTS | libstb | no fix listed | UBUNTU-CVE-2023-45663 |
| Ubuntu:25.10 | libstb | no fix listed | UBUNTU-CVE-2023-45663 |
| Ubuntu:26.04:LTS | libstb | no fix listed | UBUNTU-CVE-2023-45663 |
| Ubuntu:26.10 | libstb | no fix listed | UBUNTU-CVE-2023-45663 |
Affected products (as reported)
Weakness: CWE-908 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/ x_refsource_CONFIRM
- https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_image.h#L1664 x_refsource_MISC
- https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_image.h#L5936C10-L5936C20 x_refsource_MISC
- https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_image.h#L7221 x_refsource_MISC
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVQ7ONFH5GWLMXYEAJG32A3EUKUCEVCR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVABVF4GEM6BYD5L4L64RCRSXUHY6LGN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NMXKOKPP4BKTNUTF5KSRDQAWOUILQZNO/