CVE-2023-45667 — MEDIUM (5.3)

Vulnerability Description

stb_image is a single file MIT licensed library for processing images. If `stbi__load_gif_main` in `stbi_load_gif_from_memory` fails it returns a null pointer and may keep the `z` variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls `stbi__vertical_flip_slices` with the null pointer result value and the uninitialized `z` value. This may result in a program crash.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

LOW

Affected Products

Vendor	Product	Versions
Nothings	Stb Image.H	2.28

Related Weaknesses (CWE)

CWE-476

References

FAQ

What is CVE-2023-45667?

CVE-2023-45667 is a vulnerability with a CVSS score of 5.3 (MEDIUM). stb_image is a single file MIT licensed library for processing images. If `stbi__load_gif_main` in `stbi_load_gif_from_memory` fails it returns a null pointer and may keep the `z` variable uninitiali...

How severe is CVE-2023-45667?

CVE-2023-45667 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-45667?

Check the references section above for vendor advisories and patch information. Affected products include: Nothings Stb Image.H.