ChoeMinji / godot

MIT License
0 stars 0 forks source link

CVE-2023-45681 (High) detected in godot3.4.2-stable #58

Open mend-bolt-for-github[bot] opened 10 months ago

mend-bolt-for-github[bot] commented 10 months ago

CVE-2023-45681 - High Severity Vulnerability

Vulnerable Library - godot3.4.2-stable

Godot Engine ? Multi-platform 2D and 3D game engine

Library home page: https://github.com/godotengine/godot.git

Found in HEAD commit: 620ad7ae3fef04e165cbc3f2776d3e3bf6cfdc4d

Found in base branch: master

Vulnerable Source Files (1)

/thirdparty/misc/stb_vorbis.c

Vulnerability Details

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential integer overflow in `sizeof(char*) * (f->comment_list_length)` which may make `setup_malloc` allocate less memory than required. Since there is another integer overflow an attacker may overflow it too to force `setup_malloc` to return 0 and make the exploit more reliable. This issue may lead to code execution.

Publish Date: 2023-10-20

URL: CVE-2023-45681

CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with Mend here