CVE-2019-13217

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2019-13217
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-13217.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2019-13217
Downstream
Related
Published
2019-08-15T17:15:12Z
Modified
2025-08-09T20:01:27Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A heap buffer overflow in the startdecoder function in stbvorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file.

References

Affected packages

Git / github.com/nothings/stb

Affected ranges

Type
GIT
Repo
https://github.com/nothings/stb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
98fdfc6df88b1e34a736d5e126e6c8139c8de1a6

Database specific 

{
    "vanir_signatures": [
        {
            "source": "https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6",
            "signature_version": "v1",
            "deprecated": false,
            "id": "CVE-2019-13217-1c42ed48",
            "target": {
                "file": "stb_vorbis.c",
                "function": "lookup1_values"
            },
            "digest": {
                "function_hash": "176010929593565419870570366132122871812",
                "length": 396.0
            },
            "signature_type": "Function"
        },
        {
            "source": "https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6",
            "signature_version": "v1",
            "deprecated": false,
            "id": "CVE-2019-13217-202bad00",
            "target": {
                "file": "stb_vorbis.c",
                "function": "draw_line"
            },
            "digest": {
                "function_hash": "38743259664807125193807165025088273124",
                "length": 999.0
            },
            "signature_type": "Function"
        },
        {
            "source": "https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6",
            "signature_version": "v1",
            "deprecated": false,
            "id": "CVE-2019-13217-20ee4582",
            "target": {
                "file": "stb_vorbis.c",
                "function": "get_window"
            },
            "digest": {
                "function_hash": "56823169218052847085381425553485462626",
                "length": 240.0
            },
            "signature_type": "Function"
        },
        {
            "source": "https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6",
            "signature_version": "v1",
            "deprecated": false,
            "id": "CVE-2019-13217-42310df8",
            "target": {
                "file": "stb_vorbis.c",
                "function": "vorbis_finish_frame"
            },
            "digest": {
                "function_hash": "49004734929241009122693828815264914092",
                "length": 907.0
            },
            "signature_type": "Function"
        },
        {
            "source": "https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6",
            "signature_version": "v1",
            "deprecated": false,
            "id": "CVE-2019-13217-a63bc57e",
            "target": {
                "file": "stb_vorbis.c"
            },
            "digest": {
                "line_hashes": [
                    "180923609734588739189856917840254397986",
                    "252607128935115138867609347979665574401",
                    "26796427123339624814539309413655993171",
                    "334944010300882801179082475864151354964",
                    "67658206605730356174455511568246327830",
                    "32054017622751847918572560368764051940",
                    "105130345539269031288962039102027509643",
                    "312069930250273563036630146690773046100",
                    "144992332263051017025335560620233599571",
                    "263402010873742710886263910888899047387",
                    "56010816085399590596574206551836585149",
                    "74379356929129642717956145142656781373",
                    "48701372062214611720324684806601141730",
                    "151554948843692825085011545003179993678",
                    "212359798941917278371285785765505004721",
                    "123955861847635570517722060720314038816",
                    "131932546978733813282478864742243545646",
                    "268629459389938827506108127154524044083",
                    "28177647109481409601325394551150448368",
                    "340099141408478679196728133831585505683",
                    "314022316042983039746553310373138199226",
                    "51236374547800516072877744353296097211",
                    "277354163534557427774287892490595134166",
                    "96770047924559082761923327031591087040",
                    "235861923203456284501551308014346186917",
                    "242779809930520398167829034258602262501",
                    "112145434649265234612175017268260886208",
                    "87254796307637861096849825562765687509",
                    "11896919208289318767252302458783422756",
                    "99657188712032317845695642630100690181",
                    "167378702696938983197039676875977680350",
                    "55020713207033364137198373052290301967",
                    "40083710041787360161515583916269271624",
                    "165335388773816950758342043321907874179",
                    "210620616979404946793010040503202858698",
                    "231530106372322712692969459351607674385",
                    "265794823736632328405732879469124036896",
                    "158322104901332648333102774424583105951",
                    "175110635121604414143000173922359465246"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line"
        },
        {
            "source": "https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6",
            "signature_version": "v1",
            "deprecated": false,
            "id": "CVE-2019-13217-c1a84d67",
            "target": {
                "file": "stb_vorbis.c",
                "function": "start_decoder"
            },
            "digest": {
                "function_hash": "199470541262467489072390198469590430808",
                "length": 22489.0
            },
            "signature_type": "Function"
        }
    ]
}