Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-45662

Good to know:

icon

Date: October 20, 2023

stb_image is a single file MIT licensed library for processing images. When `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_comp` is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. A crafted image file can trigger `memcpy` out-of-bounds read because `bytes_per_pixel` used to calculate `bytes_per_row` doesn’t match the real image array dimensions.

Language: C

Severity Score

Related Resources (7)

https://nvd.nist.gov/vuln/detail/CVE-2023-45662
https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NMXKOKPP4BKTNUTF5KSRDQAWOUILQZNO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVABVF4GEM6BYD5L4L64RCRSXUHY6LGN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVQ7ONFH5GWLMXYEAJG32A3EUKUCEVCR/
https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_image.h#L1235
https://www.mend.io/vulnerability-database/CVE-2023-45662

Severity Score

Weakness Type (CWE)

Out-of-bounds Read

CWE-125

Top Fix

icon

Upgrade Version

Upgrade to version stb-sys - no_fix;tgl - 0.1.1;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.linux-musl-arm64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.12.Sdk.win-x64 - no_fix;nanovg-sys - no_fix;nanovg-sys - 1.0.0;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.linux-arm64 - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.23.Sdk.osx-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.osx-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.7.Sdk.osx-x64 - no_fix;soloud-sys - 1.0.1;webots-bindings - no_fix;vuk - no_fix;astcenc-sys - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.win-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.30.Sdk.win-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.21.Sdk.linux-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.12.Sdk.osx-x64 - no_fix;mario-deluna/php-glfw - no_fix;wfc-rs - no_fix;sstar - no_fix;torch-sys - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.osx-arm64 - no_fix;darknet - 0.3.1;darknet - 0.3.5;raylib-sys - 5.5.0;raylib-sys - 3.5.0;bgfx-sys - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.30.Sdk.osx-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.23.Sdk.win-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.12.Sdk.linux-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.linux-x64 - no_fix;diffusion-rs-sys - 0.1.4;diffusion-rs-sys - no_fix;chrono - no_fix;nvtt_sys - 0.5.0;apollo-hyper-libretro-core-beetle-psx - no_fix;sixel-sys-static - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.7.Sdk.win-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.30.Sdk.linux-x64 - no_fix;libktx-rs-sys - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.12.Sdk.linux-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.12.Sdk.win-x64 - no_fix;image2 - 0.11.3;renderkit - no_fix;raylib-ffi - 5.5.0;Microsoft.NET.Runtime.Emscripten.2.0.21.Sdk.win-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.23.Sdk.linux-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.linux-musl-x64 - no_fix;tracy-client-sys - 0.14.0;autogenerated-assimp-sys - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.21.Sdk.osx-x64 - no_fix;escapi - no_fix;libktx-sys2 - no_fix;sfml - no_fix;com.basemark.rocksolidsdk - 0.1.5;Microsoft.NET.Runtime.Emscripten.2.0.12.Sdk.osx-x64 - no_fix;nuki-sys - no_fix;darknet-sys - no_fix;torch-build - no_fix;tinygltf - 2.8.1;ncnn-sys - 0.1.7;apollo-hyper-libretro-core-beetle-ngb - no_fix;mlpack - 4.0.1;fastwfc-sys - no_fix;sixel-sys - 0.5.0;Microsoft.NET.Runtime.Emscripten.3.1.7.Sdk.linux-x64 - no_fix;ffui - no_fix;nuklear-sys - 1.33.0;ivy-image - no_fix;emscripten - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.win-arm64 - no_fix

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): LOW

Do you need more information?

Contact Us