Most recent entries from all

bdu:2024-06915

EUVD-2026-216897

fkie_cve-2023-45681

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential integer overflow in `sizeof(char*) * (f->comment_list_length)` which may make `setup_malloc` allocate less memory than required. Since there is another integer overflow an attacker may overflow it too to force `setup_malloc` to return 0 and make the exploit more reliable. This issue may lead to code execution.

gsd-2023-45681

OESA-2024-1583 — stb security update

Affected: openEuler:22.03-LTS-SP3: stb

Single-file public domain libraries for C/C++. Security Fix(es): stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential integer overflow in `sizeof(char*) * (f->comment_list_length)` which may make `setup_malloc` allocate less memory than required. Since there is another integer overflow an attacker may overflow it too to force `setup_malloc` to return 0 and make the exploit more reliable. This issue may lead to code execution.(CVE-2023-45681) A heap-based buffer overflow vulnerability exists in the comment functionality of stb _vorbis.c v1.22. A specially crafted .ogg file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.(CVE-2023-47212)

openSUSE-SU-2025:0037-1 — Security update for SDL2_sound

Security update for SDL2_sound

UBUNTU-CVE-2023-45681

Affected: Ubuntu:20.04:LTS: libstb, Ubuntu:22.04:LTS: libstb, Ubuntu:24.04:LTS: libstb, Ubuntu:25.10: libstb, Ubuntu:26.04:LTS: libstb