Debian Security Advisory
DLA-3305-1 libstb -- LTS security update
- Date Reported:
- 31 Jan 2023
- Affected Packages:
- libstb
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 934966, Bug 1014530, Bug 1023693, Bug 1014531, Bug 1014532.
In Mitre's CVE dictionary: CVE-2018-16981, CVE-2019-13217, CVE-2019-13218, CVE-2019-13219, CVE-2019-13220, CVE-2019-13221, CVE-2019-13222, CVE-2019-13223, CVE-2021-28021, CVE-2021-37789, CVE-2021-42715, CVE-2022-28041, CVE-2022-28042. - More information:
-
Several vulnerabilities have been fixed in the libstb library.
- CVE-2018-16981
Heap-based buffer overflow in stbi__out_gif_code().
- CVE-2019-13217
Heap buffer overflow in the Vorbis start_decoder().
- CVE-2019-13218
Division by zero in the Vorbis predict_point().
- CVE-2019-13219
NULL pointer dereference in the Vorbis get_window().
- CVE-2019-13220
Uninitialized stack variables in the Vorbis start_decoder().
- CVE-2019-13221
Buffer overflow in the Vorbis compute_codewords().
- CVE-2019-13222
Out-of-bounds read of a global buffer in the Vorbis draw_line().
- CVE-2019-13223
Reachable assertion in the Vorbis lookup1_values().
- CVE-2021-28021
Buffer overflow in stbi__extend_receive().
- CVE-2021-37789
Heap-based buffer overflow in stbi__jpeg_load().
- CVE-2021-42715
The HDR loader parsed truncated end-of-file RLE scanlines as an infinite sequence of zero-length runs.
- CVE-2022-28041
Integer overflow in stbi__jpeg_decode_block_prog_dc().
- CVE-2022-28042
Heap-based use-after-free in stbi__jpeg_huff_decode().
For Debian 10 buster, these problems have been fixed in version 0.0~git20180212.15.e6afb9c-1+deb10u1.
We recommend that you upgrade your libstb packages.
For the detailed security status of libstb please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libstb
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
- CVE-2018-16981