Integer Overflow Vulnerability in libstb Package Leading to Denial of Service
Summary
DEBIAN-CVE-2022-28041: stb_image.h v2.27 was discovered to contain an integer overflow via the function stbi__jpeg_decode_block_prog_dc. Affects libstb versions < 0.0~git20230129.5736b15+ds-1. Fixed in 0.0~git20230129.5736b15+ds-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libstb package is a library designed for handling various multimedia formats, including image processing. It is widely used in applications that require efficient decoding and rendering of images. However, the package has been found to contain a critical vulnerability that can be exploited by attackers to cause a Denial of Service (DoS). This vulnerability arises from the handling of JPEG image decoding, specifically in the stb_image.h file.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2022-28041 is an integer overflow that occurs in the function stbi__jpeg_decode_block_prog_dc of the stb_image.h file. This flaw allows attackers to manipulate input data, potentially leading to unexpected behavior, crashes, or resource exhaustion, thereby causing a Denial of Service (DoS). The vulnerability was discovered in version 2.27 of the library, and it affects multiple Debian releases, including Debian 13 and 14.
How To Fix
Minimum fixed version
0.0~git20230129.5736b15+ds-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libstbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted JPEG images until the package is updated to the patched version. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The integer overflow vulnerability in the libstb package poses a significant risk, allowing attackers to exploit the library for Denial of Service attacks. Users are strongly advised to update to the patched version to mitigate this risk. Additionally, using tools like Vulert can help monitor and manage vulnerabilities in open-source software effectively.
See every vulnerability recorded for libstb →
FAQ
The vulnerability is an integer overflow that can lead to Denial of Service (DoS) attacks when processing JPEG images.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
As a temporary measure, avoid processing untrusted JPEG images until you can update to the patched version.
No, the vulnerability is specifically present in version 2.27 of the library and earlier versions. The patched version resolves this issue.
You can find detailed information about this vulnerability in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-28041.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for libstb.
