stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if `len` read in `start_decoder` is a negative number and `setup_malloc` successfully allocates memory in that case, but memory write is done with a negative index `len`. Similarly if len is INT_MAX the integer overflow len+1 happens in `f->vendor = (char*)setup_malloc(f, sizeof(char) * (len+1));` and `f->comment_list[i] = (char*)setup_malloc(f, sizeof(char) * (len+1));`. This issue may lead to code execution.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c58133e520 advisory.

    Latest upstream release. Changelog:

    Fixes:

    * CVE-2023-45679: Attempt to free an uninitialized memory pointer in vorbis_deinit()
    * CVE-2023-45680: Null pointer dereference in vorbis_deinit()
    * CVE-2023-45681: Out of bounds heap buffer write
    * CVE-2023-45676: Multi-byte write heap buffer overflow in start_decoder()
    * CVE-2023-45677: Heap buffer out of bounds write in start_decoder()
    * CVE-2023-45682: Wild address read in vorbis_decode_packet_rest()

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-23e4aeeb91 advisory.

    Latest upstream release. Changelog:

    Fixes:

    * CVE-2023-45679: Attempt to free an uninitialized memory pointer in vorbis_deinit()
    * CVE-2023-45680: Null pointer dereference in vorbis_deinit()
    * CVE-2023-45681: Out of bounds heap buffer write
    * CVE-2023-45676: Multi-byte write heap buffer overflow in start_decoder()
    * CVE-2023-45677: Heap buffer out of bounds write in start_decoder()
    * CVE-2023-45682: Wild address read in vorbis_decode_packet_rest()

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 304d92c3-00c5-11ef-bd52-080027bff743 advisory.

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger out of bounds write in `f->vendor[i] = get8_packet(f);`. The root cause is an integer overflow in     `setup_malloc`. A sufficiently large value in the variable `sz` overflows with `sz+7` in and the negative     value passes the maximum available memory buffer check. This issue may lead to code execution.
    (CVE-2023-45676)

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if `len` read in     `start_decoder` is a negative number and `setup_malloc` successfully allocates memory in that case, but     memory write is done with a negative index `len`. Similarly if len is INT_MAX the integer overflow len+1     happens in `f->vendor = (char*)setup_malloc(f, sizeof(char) * (len+1));` and `f->comment_list[i] =     (char*)setup_malloc(f, sizeof(char) * (len+1));`. This issue may lead to code execution. (CVE-2023-45677)

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger memory allocation failure in `start_decoder`. In that case the function returns early, the     `f->comment_list` is set to `NULL`, but `f->comment_list_length` is not reset. Later in `vorbis_deinit` it     tries to dereference the `NULL` pointer. This issue may lead to denial of service. (CVE-2023-45680)

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential     integer overflow in `sizeof(char*) * (f->comment_list_length)` which may make `setup_malloc` allocate less     memory than required. Since there is another integer overflow an attacker may overflow it too to force     `setup_malloc` to return 0 and make the exploit more reliable. This issue may lead to code execution.
    (CVE-2023-45681)

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger out of bounds read in `DECODE` macro when `var` is negative. As it can be seen in the definition     of `DECODE_RAW` a negative `var` is a valid value. This issue may be used to leak internal memory     allocation information. (CVE-2023-45682)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
213982	Fedora 40 : libxmp (2025-c58133e520)	Nessus	Fedora Local Security Checks	high
213981	Fedora 41 : libxmp (2025-23e4aeeb91)	Nessus	Fedora Local Security Checks	high
193815	FreeBSD : sdl2_sound -- multiple vulnerabilities (304d92c3-00c5-11ef-bd52-080027bff743)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2023-45677

high

Tenable Plugins

high

high

high