{"id":"CVE-2019-13221","aliases":["DEBIAN-CVE-2019-13221","DLA-3305-1","EUVD-2019-4734","GHSA-gcp7-8ppg-gw88","UBUNTU-CVE-2019-13221","openSUSE-SU-2024:11409-1","openSUSE-SU-2025:0039-1"],"status":"published","title":"A stack buffer overflow in the compute_codewords function in stb_vorbis through 2019-03-04 allows...","description":"A stack buffer overflow in the compute_codewords function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01466,"percentile":0.7388,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2019-08-15T00:00:00Z","modified":"2026-09-21T07:02:18Z","fixes":[{"ecosystem":"Debian:12","package":"libstb","fixed_in":["0.0~git20190817.1.052dce1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libstb","fixed_in":["0.0~git20190817.1.052dce1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libstb","fixed_in":["0.0~git20190817.1.052dce1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libstb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0~git20190817.1.052dce1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libstb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0~git20190817.1.052dce1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libstb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0~git20190817.1.052dce1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libstb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0~git20180212.15.e6afb9c-1+deb10u1"}]}],"versions":["0.0~git20180212.15.e6afb9c-1"],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"stb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36.1594640766.b42009b-1.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"stb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240910-bp156.2.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"stb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240910-bp156.2.3.1"}]}],"bundled":7}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"stb_vorbis_project","product":"stb_vorbis"}],"references":[{"url":"http://nothings.org/stb_vorbis/","tags":["x_transferred","Product","web","report"]},{"url":"https://github.com/nothings/stb/commits/master/stb_vorbis.c","tags":["x_transferred","Patch","fix","report"]},{"url":"https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6","tags":["x_transferred","Patch","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00045.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13221"},{"url":"https://github.com/advisories/GHSA-gcp7-8ppg-gw88"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13221","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-13221","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13221","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13223","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PZDT6XNDTXL5IKK6DIS36QIONKMQA3A4/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216478","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-13221","description":"A stack buffer overflow in the compute_codewords function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file.","status":"published","published":"2019-08-15T00:00:00Z","modified":"2024-08-04T23:41:10.488Z","updated_at":"2026-11-02T14:20:24.357095Z"}],"euvd":[{"id":"EUVD-2019-4734","description":"A stack buffer overflow in the compute_codewords function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file.","status":"published","published":"2019-08-15T00:00:00Z","modified":"2024-08-04T23:41:10Z","updated_at":"2026-11-03T02:40:43.368399Z"}],"ghsa":[{"id":"GHSA-gcp7-8ppg-gw88","title":"A stack buffer overflow in the compute_codewords function in stb_vorbis through 2019-03-04 allows...","description":"A stack buffer overflow in the compute_codewords function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file.","status":"published","published":"2022-05-24T16:53:41Z","modified":"2023-02-01T00:30:29Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:49:32.359752Z"}],"nvd":[{"id":"CVE-2019-13221","description":"A stack buffer overflow in the compute_codewords function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file.","status":"published","published":"2019-08-15T17:15:13.177Z","modified":"2026-06-17T02:16:19.2Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:05:22.878504Z"}],"osv":[{"id":"CVE-2019-13221","description":"A stack buffer overflow in the compute_codewords function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file.","status":"published","published":"2019-08-15T17:15:13.177Z","modified":"2026-03-15T21:56:03.835965Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-13221","description":"A stack buffer overflow in the compute_codewords function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file.","status":"published","published":"2019-08-15T17:15:13.177Z","modified":"2026-09-21T07:02:18.226295408Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-13221","description":"A stack buffer overflow in the compute_codewords function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file.","status":"withdrawn","published":"2019-08-15T17:15:00Z","modified":"2025-07-16T08:14:22.833602Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-3305-1","title":"libstb - security update","status":"published","published":"2023-01-31T00:00:00Z","modified":"2026-03-09T01:20:44.847628Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"openSUSE-SU-2024:11409-1","title":"stb-devel-2.36.1594640766.b42009b-1.4 on GA media","description":"These are all security issues fixed in the stb-devel-2.36.1594640766.b42009b-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:47:10.533854Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2025:0039-1","title":"Security update for stb","description":"This update for stb fixes the following issues:\n\nAddressing the follow security issues (boo#1216478):\n\n* CVE-2019-13217: heap buffer overflow in start_decoder()\n* CVE-2019-13218: stack buffer overflow in compute_codewords()\n* CVE-2019-13219: uninitialized memory in vorbis_decode_packet_rest()\n* CVE-2019-13220: out-of-range read in draw_line()\n* CVE-2019-13221: issue with large 1D codebooks in lookup1_values()\n* CVE-2019-13222: unchecked NULL returned by get_window()\n* CVE-2019-13223: division by zero in predict_point()\n","status":"published","published":"2025-01-31T15:01:17Z","modified":"2026-02-04T03:39:39.100944Z","updated_at":"2026-11-02T16:58:36.976155Z"}]}}