« Volver al listado

CVE-2019-15058

Estado: ModificadaCrítica (9.1)—

stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information Disclosure or Denial of Service.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

STB Project — STB

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-15058",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-08-14T21:15:13.687",
  "references": [
    {
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934973",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/nothings/stb/issues/790",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://security-tracker.debian.org/tracker/CVE-2019-15058",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.cvedetails.com/cve/CVE-2019-15058/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1695025.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.suse.com/security/cve/CVE-2019-15058/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934973",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/nothings/stb/issues/790",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security-tracker.debian.org/tracker/CVE-2019-15058",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cvedetails.com/cve/CVE-2019-15058/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1695025.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.suse.com/security/cve/CVE-2019-15058/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information Disclosure or Denial of Service."
    },
    {
      "lang": "es",
      "value": "El archivo stb_image.h (también se conoce como stb image loader) versión 2.23, tiene una lectura excesiva de búfer en la región heap de la memoria en la función stbi__tga_load, conllevando a la divulgación de información o la denegación de servicio."
    }
  ],
  "lastModified": "2026-06-17T02:19:37.527",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:stb_project:stb:2.23:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAC51233-5119-4F4E-B6DF-E29385B6E5D9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}