Denial of Service Vulnerability in stb_vorbis Library by Nothings
CVE-2019-13223

5.5MEDIUM

Key Information:

Vendor

Stb Vorbis Project

Status
Stb Vorbis
Vendor
CVE Published:
15 August 2019

What is CVE-2019-13223?

The stb_vorbis library contains a reachable assertion within the lookup1_values function, which can be exploited by attackers. By supplying a specially crafted Ogg Vorbis file, an attacker may trigger a denial of service condition, potentially leading to disruption in services that rely on this library for audio file parsing. Users of stb_vorbis should update to the latest version or apply recommended fixes to mitigate this vulnerability.

References

http://nothings.org/stb_vorbis/
https://github.com/nothings/stb/commits/master/stb_vorbis.c
https://github.com/nothings/stb/commit/98fdfc6df88b1e34a7...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.