Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-45664

Good to know:

icon

Date: October 20, 2023

stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free the out variable. This happens in `stbi__load_gif_main` because when the `layers * stride` value is zero the behavior is implementation defined, but common that realloc frees the old memory and returns null pointer. Since it attempts to double-free the memory a few lines below the first “free”, the issue can be potentially exploited only in a multi-threaded environment. In the worst case this may lead to code execution.

Language: C

Severity Score

Related Resources (7)

https://nvd.nist.gov/vuln/detail/CVE-2023-45664
https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/
https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_image.h#L6993-L6995
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NMXKOKPP4BKTNUTF5KSRDQAWOUILQZNO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVABVF4GEM6BYD5L4L64RCRSXUHY6LGN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVQ7ONFH5GWLMXYEAJG32A3EUKUCEVCR/
https://www.mend.io/vulnerability-database/CVE-2023-45664

Severity Score

Weakness Type (CWE)

Double Free

CWE-415

Top Fix

icon

Upgrade Version

Upgrade to version Microsoft.NET.Runtime.Emscripten.2.0.12.Sdk.win-x64 - no_fix;com.basemark.rocksolidsdk - 0.1.5;raylib-sys - 5.5.0;raylib-sys - 3.5.0;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.osx-arm64 - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.12.Sdk.osx-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.linux-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.linux-arm64 - no_fix;diffusion-rs-sys - no_fix;diffusion-rs-sys - 0.1.4;darknet - 0.3.5;darknet - 0.3.1;soloud-sys - 1.0.1;sfml - no_fix;bgfx-sys - no_fix;libktx-sys2 - no_fix;ivy-image - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.12.Sdk.linux-x64 - no_fix;apollo-hyper-libretro-core-beetle-psx - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.23.Sdk.win-x64 - no_fix;chrono - no_fix;tinygltf - 2.8.1;nvtt_sys - 0.5.0;fastwfc-sys - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.7.Sdk.linux-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.30.Sdk.linux-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.12.Sdk.osx-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.osx-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.21.Sdk.linux-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.12.Sdk.linux-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.30.Sdk.win-x64 - no_fix;astcenc-sys - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.21.Sdk.osx-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.7.Sdk.win-x64 - no_fix;nanovg-sys - no_fix;nanovg-sys - 1.0.0;escapi - no_fix;torch-sys - no_fix;raylib-ffi - 5.5.0;stb-sys - no_fix;ncnn-sys - 0.1.7;ffui - no_fix;torch-build - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.30.Sdk.osx-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.23.Sdk.linux-x64 - no_fix;tracy-client-sys - 0.14.0;sixel-sys-static - no_fix;sixel-sys - 0.5.0;libktx-rs-sys - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.12.Sdk.win-x64 - no_fix;renderkit - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.win-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.win-arm64 - no_fix;sstar - no_fix;mario-deluna/php-glfw - no_fix;emscripten - no_fix;mlpack - 4.0.1;nuklear-sys - 1.33.0;apollo-hyper-libretro-core-beetle-ngb - no_fix;image2 - 0.11.3;Microsoft.NET.Runtime.Emscripten.2.0.23.Sdk.osx-x64 - no_fix;tgl - 0.1.1;nuki-sys - no_fix;darknet-sys - no_fix;webots-bindings - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.21.Sdk.win-x64 - no_fix;autogenerated-assimp-sys - no_fix;wfc-rs - no_fix;vuk - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.linux-musl-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.linux-musl-arm64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.7.Sdk.osx-x64 - no_fix

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): LOW

Do you need more information?

Contact Us