CVE-2023-45679 Attempt to free an uninitialized memory pointer in vorbis_deinit in stb_vorbis
A crafted Ogg Vorbis file can trigger a use-after-free in stb_vorbis, potentially allowing remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-45679?
CVE-2023-45679 is a high-severity use after free vulnerability in nothings stb, published on 20 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In that case the function returns early, but some of the pointers in `f->comment_list` are left initialized and later `setup_free` is called on these pointers in `vorbis_deinit`. This issue may lead to code execution.
Weakness: CWE-415
Which versions are affected by CVE-2023-45679?
It affects 1 product.
Products include Nothings Stb Vorbis.c.
How do I fix CVE-2023-45679?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-45679 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-45679 exists.
Other vulnerabilities in nothings stb
- CVE-2023-45676 Multi-byte write heap buffer overflow in start_decoder in stb_vorbis
- CVE-2023-45677 Heap buffer out of bounds write in start_decoder in stb_vorbis
- CVE-2023-45681 Out of bounds heap buffer write in stb_vorbis
- CVE-2023-45675 0 byte write heap buffer overflow in start_decoder in stb_vorbis
- CVE-2023-45678 Off-by-one heap buffer write in start_decoder in stb_vorbis
Sources
Also known as DEBIAN-CVE-2023-45679, UBUNTU-CVE-2023-45679.