stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if `len` read in `start_decoder` is a negative number and `setup_malloc` successfully allocates memory in that case, but memory write is done with a negative index `len`. Similarly if len is INT_MAX the integer overflow len+1 happens in `f->vendor = (char*)setup_malloc(f, sizeof(char) * (len+1));` and `f->comment_list[i] = (char*)setup_malloc(f, sizeof(char) * (len+1));`. This issue may lead to code execution.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 304d92c3-00c5-11ef-bd52-080027bff743 advisory.

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger out of bounds write in `f->vendor[i] = get8_packet(f);`. The root cause is an integer overflow in     `setup_malloc`. A sufficiently large value in the variable `sz` overflows with `sz+7` in and the negative     value passes the maximum available memory buffer check. This issue may lead to code execution.
    (CVE-2023-45676)

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if `len` read in     `start_decoder` is a negative number and `setup_malloc` successfully allocates memory in that case, but     memory write is done with a negative index `len`. Similarly if len is INT_MAX the integer overflow len+1     happens in `f->vendor = (char*)setup_malloc(f, sizeof(char) * (len+1));` and `f->comment_list[i] =     (char*)setup_malloc(f, sizeof(char) * (len+1));`. This issue may lead to code execution. (CVE-2023-45677)

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger memory allocation failure in `start_decoder`. In that case the function returns early, the     `f->comment_list` is set to `NULL`, but `f->comment_list_length` is not reset. Later in `vorbis_deinit` it     tries to dereference the `NULL` pointer. This issue may lead to denial of service. (CVE-2023-45680)

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential     integer overflow in `sizeof(char*) * (f->comment_list_length)` which may make `setup_malloc` allocate less     memory than required. Since there is another integer overflow an attacker may overflow it too to force     `setup_malloc` to return 0 and make the exploit more reliable. This issue may lead to code execution.
    (CVE-2023-45681)

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger out of bounds read in `DECODE` macro when `var` is negative. As it can be seen in the definition     of `DECODE_RAW` a negative `var` is a valid value. This issue may be used to leak internal memory     allocation information. (CVE-2023-45682)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CVE-2023-45677

high

Tenable Plugins

high