CVE-2019-13219

low-risk
Published 2019-08-15

A NULL pointer dereference in the get_window function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file.

Do I need to act?

-
0.22% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (2)

Stb Vorbis

Affected Vendors

Debian Stb Vorbis Project

References (8)

Product http://nothings.org/stb_vorbis/
Patch https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6
Patch https://github.com/nothings/stb/commits/master/stb_vorbis.c
Mailing List https://lists.debian.org/debian-lts-announce/2023/01/msg00045.html
Product http://nothings.org/stb_vorbis/
Patch https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6
Patch https://github.com/nothings/stb/commits/master/stb_vorbis.c
Mailing List https://lists.debian.org/debian-lts-announce/2023/01/msg00045.html
26
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 7/34 · Low