snykiotcubedev / godot-3.3-stable

MIT License
0 stars 0 forks source link

CVE-2023-45681 (High) detected in godot3.4.2-stable #60

Open mend-bolt-for-github[bot] opened 10 months ago

mend-bolt-for-github[bot] commented 10 months ago

CVE-2023-45681 - High Severity Vulnerability

Vulnerable Library - godot3.4.2-stable

Godot Engine ? Multi-platform 2D and 3D game engine

Library home page: https://github.com/godotengine/godot.git

Found in HEAD commit: e6580209fab1312cb824a455d2df99df8a9fb156

Found in base branch: main

Vulnerable Source Files (1)

/thirdparty/misc/stb_vorbis.c

Vulnerability Details

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential integer overflow in `sizeof(char*) * (f->comment_list_length)` which may make `setup_malloc` allocate less memory than required. Since there is another integer overflow an attacker may overflow it too to force `setup_malloc` to return 0 and make the exploit more reliable. This issue may lead to code execution.

Publish Date: 2023-10-20

URL: CVE-2023-45681

CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with Mend here