There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - stb_image is a single file MIT licensed library for processing images. It may look like
    `stbi__load_gif_main` doesn’t give guarantees about the content of output value `*delays` upon failure.
    Although it sets `*delays` to zero at the beginning, it doesn’t do it in case the image is not recognized
    as GIF and a call to `stbi__load_gif_main_outofmem` only frees possibly allocated memory in `*delays`
    without resetting it to zero. Thus it would be fair to say the caller of `stbi__load_gif_main` is
    responsible to free the allocated memory in `*delays` only if `stbi__load_gif_main` returns a non null
    value. However at the same time the function may return null value, but fail to free the memory in
    `*delays` if internally `stbi__convert_format` is called and fails. Thus the issue may lead to a memory
    leak if the caller chooses to free `delays` only when `stbi__load_gif_main` didn’t fail or to a double-
    free if the `delays` is always freed (CVE-2023-45666)

  - Nothings stb 2.28 was discovered to contain a Null Pointer Dereference via the function
    stbi__convert_format. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted
    pic file. (CVE-2023-43898)

  - stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger
    out of bounds memcpy read in `stbi__gif_load_next`. This happens because two_back points to a memory
    address lower than the start of the buffer out. This issue may be used to leak internal memory allocation
    information. (CVE-2023-45661)

  - stb_image is a single file MIT licensed library for processing images. When
    `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_comp` is set to a number that doesn’t match
    the real number of components per pixel, the library attempts to flip the image vertically. A crafted
    image file can trigger `memcpy` out-of-bounds read because `bytes_per_pixel` used to calculate
    `bytes_per_row` doesn’t match the real image array dimensions. (CVE-2023-45662)

  - stb_image is a single file MIT licensed library for processing images. The stbi__getn function reads a
    specified number of bytes from context (typically a file) into the specified buffer. In case the file
    stream points to the end, it returns zero. There are two places where its return value is not checked: In
    the `stbi__hdr_load` function and in the `stbi__tga_load` function. The latter of the two is likely more
    exploitable as an attacker may also control the size of an uninitialized buffer. (CVE-2023-45663)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 發現Nothings stb 2.28 透過 stbi__convert_format 函式發生 Null 指標解除參照。此弱點允許攻擊者透過特製的 pic 檔案造成拒絕服務 (DoS)。 (CVE-2023-43898)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 发现 Nothings stb 2.28 包含通过函数 stbi__convert_format 实现的空指针取消引用。此漏洞允许攻击者通过特制的 pic 文件造成拒绝服务 (DoS)。 (CVE-2023-43898)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 何もない stb 2.28 が、関数 stbi__convert_format を通じた Null ポインターデリファレンスを含むことが発見されました。この脆弱性により、攻撃者が細工されたpicファイルを介してサービス拒否（DoS）を引き起こす可能性があります。 （CVE-2023-43898）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Nothings stb 2.28 was discovered to contain a Null Pointer Dereference via the function     stbi__convert_format. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted     pic file. (CVE-2023-43898)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
408136	Alpine: multiple stb packages: security update to 0_git20231012-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/12/7	2026/7/2	critical
408136	Alpine: multiple stb packages: security update to 0_git20231012-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/12/7	2026/7/2	critical
232041	Linux Distros 未修補弱點：CVE-2023-43898	Nessus	Misc.	2025/3/6	2026/7/17	medium
232041	Linux Distros 未修补的漏洞: CVE-2023-43898	Nessus	Misc.	2025/3/6	2026/7/17	medium
232041	Linux Distros のパッチ未適用の脆弱性: CVE-2023-43898	Nessus	Misc.	2025/3/6	2026/7/17	medium
232041	Linux Distros Unpatched Vulnerability : CVE-2023-43898	Nessus	Misc.	2025/3/6	2026/7/17	medium

检测

插件搜索

critical

critical

medium

medium

medium

medium