{"id":"GHSA-ppjr-267j-5p9x","aliases":["RUSTSEC-2023-0021"],"status":"published","title":"NULL pointer derefernce in `stb_image`","description":"A bug in error handling in the `stb_image` C library could cause a NULL pointer dereference when attempting to load an invalid or unsupported image file.  This is fixed in version 0.2.5 and later of the `stb_image` Rust crate, by patching the C code to correctly handle NULL pointers.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2023-03-19T12:00:00Z","modified":"2023-11-08T04:21:46Z","fixes":[{"ecosystem":"crates.io","package":"stb_image","fixed_in":["0.2.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"stb_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5"}]}]},{"source":"osv","ecosystem":"crates.io","package":"stb_image","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.5"}]}]},{"source":"osv","ecosystem":"crates.io","package":"stb_image","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.2.5"}]}]}],"references":[{"url":"https://github.com/servo/rust-stb-image/pull/102","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0021.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-ppjr-267j-5p9x"},{"url":"https://github.com/servo/rust-stb-imag","tags":["package"]},{"url":"https://crates.io/crates/stb_image","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-ppjr-267j-5p9x","title":"NULL pointer derefernce in `stb_image`","description":"A bug in error handling in the `stb_image` C library could cause a NULL pointer dereference when attempting to load an invalid or unsupported image file.  This is fixed in version 0.2.5 and later of the `stb_image` Rust crate, by patching the C code to correctly handle NULL pointers.\n","status":"published","published":"2023-03-20T21:11:58Z","modified":"2023-07-19T19:19:44Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:36:57.310051Z"}],"osv":[{"id":"GHSA-ppjr-267j-5p9x","title":"NULL pointer derefernce in `stb_image`","description":"A bug in error handling in the `stb_image` C library could cause a NULL pointer dereference when attempting to load an invalid or unsupported image file.  This is fixed in version 0.2.5 and later of the `stb_image` Rust crate, by patching the C code to correctly handle NULL pointers.\n","status":"published","published":"2023-03-20T21:11:58Z","modified":"2023-11-08T04:21:46.866404Z","cwes":["CWE-476"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"RUSTSEC-2023-0021","title":"NULL pointer dereference in `stb_image`","description":"A bug in error handling in the `stb_image` C library could cause a NULL pointer dereference when attempting to load an invalid or unsupported image file.  This is fixed in version 0.2.5 and later of the `stb_image` Rust crate, by patching the C code to correctly handle NULL pointers.\n\nThank you to GitHub user 0xdd96 for finding and fixing this vulnerability.","status":"published","published":"2023-03-19T12:00:00Z","modified":"2023-11-08T04:21:46.866404Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}