stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential integer overflow in `sizeof(char*) * (f->comment_list_length)` which may make `setup_malloc` allocate less memory than required. Since there is another integer overflow an attacker may overflow it too to force `setup_malloc` to return 0 and make the exploit more reliable. This issue may lead to code execution.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential     integer overflow in `sizeof(char*) * (f->comment_list_length)` which may make `setup_malloc` allocate less     memory than required. Since there is another integer overflow an attacker may overflow it too to force     `setup_malloc` to return 0 and make the exploit more reliable. This issue may lead to code execution.
    (CVE-2023-45681)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:0037-1 advisory.

    - Update to release 2.0.4:
      * Update bundled stb_vorbis to address CVE-2023-45676,         CVE-2023-45677, CVE-2023-45679, CVE-2023-45680,         CVE-2023-45681, CVE-2023-45682.

    - Update to release 2.0.2
      * No further changes from the last snapshot 2.0.1+g60

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c58133e520 advisory.

    Latest upstream release. Changelog:

    Fixes:

    * CVE-2023-45679: Attempt to free an uninitialized memory pointer in vorbis_deinit()
    * CVE-2023-45680: Null pointer dereference in vorbis_deinit()
    * CVE-2023-45681: Out of bounds heap buffer write
    * CVE-2023-45676: Multi-byte write heap buffer overflow in start_decoder()
    * CVE-2023-45677: Heap buffer out of bounds write in start_decoder()
    * CVE-2023-45682: Wild address read in vorbis_decode_packet_rest()

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-23e4aeeb91 advisory.

    Latest upstream release. Changelog:

    Fixes:

    * CVE-2023-45679: Attempt to free an uninitialized memory pointer in vorbis_deinit()
    * CVE-2023-45680: Null pointer dereference in vorbis_deinit()
    * CVE-2023-45681: Out of bounds heap buffer write
    * CVE-2023-45676: Multi-byte write heap buffer overflow in start_decoder()
    * CVE-2023-45677: Heap buffer out of bounds write in start_decoder()
    * CVE-2023-45682: Wild address read in vorbis_decode_packet_rest()

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-4c8d4cda0d advisory.

    Security fix for CVE-2023-45681 / CVE-2023-47212

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-5e5d8c2581 advisory.

    Security fix for CVE-2023-45681 / CVE-2023-47212

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-8f4d69d2ec advisory.

    Security fix for CVE-2023-45681 / CVE-2023-47212

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 304d92c3-00c5-11ef-bd52-080027bff743 advisory.

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger out of bounds write in `f->vendor[i] = get8_packet(f);`. The root cause is an integer overflow in     `setup_malloc`. A sufficiently large value in the variable `sz` overflows with `sz+7` in and the negative     value passes the maximum available memory buffer check. This issue may lead to code execution.
    (CVE-2023-45676)

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if `len` read in     `start_decoder` is a negative number and `setup_malloc` successfully allocates memory in that case, but     memory write is done with a negative index `len`. Similarly if len is INT_MAX the integer overflow len+1     happens in `f->vendor = (char*)setup_malloc(f, sizeof(char) * (len+1));` and `f->comment_list[i] =     (char*)setup_malloc(f, sizeof(char) * (len+1));`. This issue may lead to code execution. (CVE-2023-45677)

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger memory allocation failure in `start_decoder`. In that case the function returns early, the     `f->comment_list` is set to `NULL`, but `f->comment_list_length` is not reset. Later in `vorbis_deinit` it     tries to dereference the `NULL` pointer. This issue may lead to denial of service. (CVE-2023-45680)

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential     integer overflow in `sizeof(char*) * (f->comment_list_length)` which may make `setup_malloc` allocate less     memory than required. Since there is another integer overflow an attacker may overflow it too to force     `setup_malloc` to return 0 and make the exploit more reliable. This issue may lead to code execution.
    (CVE-2023-45681)

  - stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may     trigger out of bounds read in `DECODE` macro when `var` is negative. As it can be seen in the definition     of `DECODE_RAW` a negative `var` is a valid value. This issue may be used to leak internal memory     allocation information. (CVE-2023-45682)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
232089	Linux Distros Unpatched Vulnerability : CVE-2023-45681	Nessus	Misc.	high
214887	openSUSE 15 Security Update : SDL2_sound (openSUSE-SU-2025:0037-1)	Nessus	SuSE Local Security Checks	high
213982	Fedora 40 : libxmp (2025-c58133e520)	Nessus	Fedora Local Security Checks	high
213981	Fedora 41 : libxmp (2025-23e4aeeb91)	Nessus	Fedora Local Security Checks	high
195470	Fedora 39 : stb (2024-4c8d4cda0d)	Nessus	Fedora Local Security Checks	critical
195469	Fedora 38 : stb (2024-5e5d8c2581)	Nessus	Fedora Local Security Checks	critical
195324	Fedora 40 : stb (2024-8f4d69d2ec)	Nessus	Fedora Local Security Checks	critical
193815	FreeBSD : sdl2_sound -- multiple vulnerabilities (304d92c3-00c5-11ef-bd52-080027bff743)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2023-45681

high

Tenable Plugins

high

high

high

high

critical

critical

critical

high