CVE-2023-47212 — Vulnetix

CVE-2023-47212 PUBLISHED CVSS 9.800000190734863 CRITICAL

A heap-based buffer overflow vulnerability exists in the comment functionality of stb _vorbis.c v1.22. A specially crafted .ogg file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.

EPSS 0.27% · 51.0th percentile

Risk Scores

CVSS 3.1

9.800000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.27%

51.0th percentile

Affected Products

Vendor	Product	Versions
nothings	stb_vorbis.c	1.22
fedoraproject	fedora	38, 39, 40
stb_vorbis_project	stb_vorbis	1.22
stb	stb_vorbis.c	v1.22

Timeline

May 1, 2024 CVE Published
May 2, 2024 EPSS Score
May 26, 2024 EPSS Score
Jun 21, 2024 EPSS Score
Jul 15, 2024 EPSS Score
Aug 8, 2024 EPSS Score
Sep 2, 2024 EPSS Score
Sep 26, 2024 EPSS Score
Oct 20, 2024 EPSS Score
Dec 9, 2024 EPSS Score
Jan 2, 2025 EPSS Score
Jan 27, 2025 EPSS Score

References

https://talosintelligence.com/vulnerability_reports/TALOS-2023-1846 url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LBIPXOBWUHPAH4QHMVP2AWWAPDDZDQ66/ url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WRORYQ2Z2XXHPX36JHBUSDVY6IOMW2N/ url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MHQQXX27ACLLYUQHWSL3DVCOGUK5ZA4/ url
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1846 url
https://nvd.nist.gov/vuln/detail/CVE-2023-47212 advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MHQQXX27ACLLYUQHWSL3DVCOGUK5ZA4 url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WRORYQ2Z2XXHPX36JHBUSDVY6IOMW2N url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LBIPXOBWUHPAH4QHMVP2AWWAPDDZDQ66 url

Open in Interactive Console →