Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-45667

Good to know:

icon

Date: October 20, 2023

stb_image is a single file MIT licensed library for processing images. If `stbi__load_gif_main` in `stbi_load_gif_from_memory` fails it returns a null pointer and may keep the `z` variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls `stbi__vertical_flip_slices` with the null pointer result value and the uninitialized `z` value. This may result in a program crash.

Language: C

Severity Score

Related Resources (8)

https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_image.h#L1448
https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NMXKOKPP4BKTNUTF5KSRDQAWOUILQZNO/
https://nvd.nist.gov/vuln/detail/CVE-2023-45667
https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_image.h#L1442-L1454
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVABVF4GEM6BYD5L4L64RCRSXUHY6LGN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVQ7ONFH5GWLMXYEAJG32A3EUKUCEVCR/
https://www.mend.io/vulnerability-database/CVE-2023-45667

Severity Score

Weakness Type (CWE)

NULL Pointer Dereference

CWE-476

Top Fix

icon

Upgrade Version

Upgrade to version nuklear-sys - 1.33.0;mario-deluna/php-glfw - no_fix;tgl - 0.1.1;ivy-image - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.linux-arm64 - no_fix;diffusion-rs-sys - no_fix;diffusion-rs-sys - 0.1.4;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.osx-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.12.Sdk.osx-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.23.Sdk.osx-x64 - no_fix;nanovg-sys - no_fix;nanovg-sys - 1.0.0;wfc-rs - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.12.Sdk.win-x64 - no_fix;astcenc-sys - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.7.Sdk.osx-x64 - no_fix;stb-sys - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.21.Sdk.linux-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.30.Sdk.win-x64 - no_fix;sstar - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.linux-musl-arm64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.win-x64 - no_fix;vuk - no_fix;darknet - 0.3.5;darknet - 0.3.1;torch-build - no_fix;sfml - no_fix;ncnn-sys - 0.1.7;tinygltf - 2.8.1;libktx-sys2 - no_fix;nuki-sys - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.12.Sdk.osx-x64 - no_fix;com.basemark.rocksolidsdk - 0.1.5;mlpack - 4.0.1;apollo-hyper-libretro-core-beetle-ngb - no_fix;emscripten - no_fix;fastwfc-sys - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.7.Sdk.linux-x64 - no_fix;ffui - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.win-arm64 - no_fix;sixel-sys - 0.5.0;image2 - 0.11.3;Microsoft.NET.Runtime.Emscripten.2.0.23.Sdk.linux-x64 - no_fix;tracy-client-sys - 0.14.0;renderkit - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.21.Sdk.win-x64 - no_fix;escapi - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.12.Sdk.linux-x64 - no_fix;darknet-sys - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.21.Sdk.osx-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.linux-musl-x64 - no_fix;autogenerated-assimp-sys - no_fix;raylib-ffi - 5.5.0;bgfx-sys - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.23.Sdk.win-x64 - no_fix;torch-sys - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.osx-arm64 - no_fix;raylib-sys - 5.5.0;raylib-sys - 3.5.0;webots-bindings - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.12.Sdk.win-x64 - no_fix;sixel-sys-static - no_fix;chrono - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.linux-x64 - no_fix;soloud-sys - 1.0.1;Microsoft.NET.Runtime.Emscripten.3.1.7.Sdk.win-x64 - no_fix;Microsoft.NET.Runtime.Emscripten.3.1.30.Sdk.osx-x64 - no_fix;libktx-rs-sys - no_fix;apollo-hyper-libretro-core-beetle-psx - no_fix;Microsoft.NET.Runtime.Emscripten.2.0.12.Sdk.linux-x64 - no_fix;nvtt_sys - 0.5.0;Microsoft.NET.Runtime.Emscripten.3.1.30.Sdk.linux-x64 - no_fix

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): LOW

Do you need more information?

Contact Us