deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-1222
Published: 2019-08-14
Description: A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP.
The update addresses the vulnerability by correcting how Remote Desktop Services handles connection requests.
CVSS Score: 9.8 (CRITICAL)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190819-01-windows-en; https://cert-portal.siemens.com/productcert/pdf/ssa-187667.pdf; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1222
CVE: CVE-2019-1223
Published: 2019-08-14
Description: A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RDP service on the target system to stop responding.
To exploit this vulnerability, an attacker would need to run a specially crafted application against a server which provides Remote Desktop Protocol (RDP) services.
The update addresses the vulnerability by correcting how RDP handles connection requests.
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1223; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1223
CVE: CVE-2019-1224
Published: 2019-08-14
Description: An information disclosure vulnerability exists when the Windows RDP server improperly discloses the contents of its memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the system.
To exploit this vulnerability, an attacker would have to connect remotely to an affected system and run a specially crafted application.
The security update addresses the vulnerability by correcting how the Windows RDP server initializes memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1224; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1224
CVE: CVE-2019-1225
Published: 2019-08-14
Description: An information disclosure vulnerability exists when the Windows RDP server improperly discloses the contents of its memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the system.
To exploit this vulnerability, an attacker would have to connect remotely to an affected system and run a specially crafted application.
The security update addresses the vulnerability by correcting how the Windows RDP server initializes memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1225; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1225
CVE: CVE-2019-1226
Published: 2019-08-14
Description: A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP.
The update addresses the vulnerability by correcting how Remote Desktop Services handles connection requests.
CVSS Score: 9.8 (CRITICAL)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190819-01-windows-en; https://cert-portal.siemens.com/productcert/pdf/ssa-187667.pdf; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1226
CVE: CVE-2019-1227
Published: 2019-08-14
Description: An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.
To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.
The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1227; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1227
CVE: CVE-2019-1228
Published: 2019-08-14
Description: An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.
To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.
The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1228; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1228
CVE: CVE-2019-1229
Published: 2019-08-14
Description: An elevation of privilege vulnerability exists in Dynamics On-Premise v9. An attacker who successfully exploited the vulnerability could leverage a customizer privilege within Dynamics to gain control of the Web Role hosting the Dynamics installation.
To exploit this vulnerability, an attacker needs to have credentials for a user that has permission to author customized business rules in Dynamics, and persist XAML script in a way that causes it to be interpreted as code.
The update addresses the vulnerability by restricting XAML activities to a whitelisted set.
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1229; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1229
CVE: CVE-2019-1258
Published: 2019-08-14
Description: An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens. This vulnerability allows an authenticated attacker to perform actions in context of another user.
The authenticated attacker can exploit this vulneraiblity by accessing a service configured for On-Behalf-Of flow that assigns incorrect tokens.
This security update addresses the vulnerability by removing fallback cache look-up for On-Behalf-Of scenarios.
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1258; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1258
CVE: CVE-2019-9584
Published: 2019-08-14
Description: eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting down the VPN service and to delete the VPN service configuration. This is related to improper access control for all /addons/mh/ pages.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-425
References: https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-03-27-CVE-2019-9584.md; https://psytester.github.io/CVE-2019-9584/; https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-03-27-CVE-2019-9584.md
CVE: CVE-2019-9585
Published: 2019-08-14
Description: eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.***Metadata related operations, resulting in the ability to read, set and deletion of Metadata.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-03-27-CVE-2019-9585.md; https://psytester.github.io/CVE-2019-9585/; https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-03-27-CVE-2019-9585.md
CVE: CVE-2019-14427
Published: 2019-08-14
Description: XSS exists in WEB STUDIO Ultimate Loan Manager 2.0 by adding a branch under the Branches button that sets the notes parameter with crafted JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/47198; https://www.exploit-db.com/exploits/47198
CVE: CVE-2019-15062
Published: 2019-08-14
Description: An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this mechanism is bypassed.)
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: https://gauravnarwani.com/publications/CVE-2019-15062/; https://github.com/Dolibarr/dolibarr/issues/11671; https://gauravnarwani.com/publications/CVE-2019-15062/
CVE: CVE-2019-14755
Published: 2019-08-15
Description: The profile photo upload feature in Leaf Admin 61.9.0212.10 f allows Unrestricted Upload of a File with a Dangerous Type.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://intruderlabs.com.br/; http://leaftecnologia.com.br/; https://gist.github.com/alacerda/8fd4557e585a8707e9d3b798968e24c1
CVE: CVE-2019-14790
Published: 2019-08-15
Description: The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/limb-gallery/#developers; https://wpvulndb.com/vulnerabilities/9517; https://www.pluginvulnerabilities.com/2019/06/26/what-would-hackers-be-interested-in-the-wordpress-plugin-limb-gallery-for/
CVE: CVE-2019-14795
Published: 2019-08-15
Description: The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/toggle-the-title/#developers; https://wpvulndb.com/vulnerabilities/9516; https://www.pluginvulnerabilities.com/2019/05/16/is-this-authenticated-persistent-cross-site-scripting-xss-vulnerability-what-hackers-would-be-interested-in-toggle-the-title-for/
CVE: CVE-2019-14800
Published: 2019-08-15
Description: The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers; https://www.pluginvulnerabilities.com/2019/05/15/information-disclosure-vulnerability-in-fv-player-fv-flowplayer-video-player/; https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers
CVE: CVE-2019-15081
Published: 2019-08-15
Description: OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154286/Opencart-3.x-Cross-Site-Scripting.html; https://github.com/nipunsomani/Opencart-3.x.x-Authenticated-Stored-XSS/blob/master/README.md; http://packetstormsecurity.com/files/154286/Opencart-3.x-Cross-Site-Scripting.html
CVE: CVE-2019-3417
Published: 2019-08-15
Description: All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by command injection vulnerability. Due to insufficient parameter validation check, an authorized user can exploit this vulnerability to take control of user router system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010163; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010163
CVE: CVE-2019-3418
Published: 2019-08-15
Description: All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by cross-site scripting vulnerability (XSS). Due to incomplete input validation, an authorized user can exploit this vulnerability to execute malicious scripts.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010163; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010163
CVE: CVE-2019-13578
Published: 2019-08-15
Description: A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fortiguard.com/zeroday/FG-VD-19-098; https://github.com/impress-org/give/commit/894937d7927eab0c98457656cbd6fb414b3a6fbf; https://github.com/impress-org/give/commit/97b9b5fae2d10742ee42fe00092729fa7da3cb32
CVE: CVE-2019-14518
Published: 2019-08-15
Description: Evolution CMS 2.0.x allows XSS via a description and new category location in a template. NOTE: the vendor states that the behavior is consistent with the "access policy in the administration panel.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/evolution-cms/evolution/issues/1041; https://github.com/evolution-cms/evolution/issues/1042; https://github.com/evolution-cms/evolution/issues/1043
CVE: CVE-2019-14784
Published: 2019-08-15
Description: The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers; https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers
CVE: CVE-2019-14786
Published: 2019-08-15
Description: The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://rankmath.com/changelog/; https://wpvulndb.com/vulnerabilities/9375; https://www.pluginvulnerabilities.com/2019/06/20/authenticated-settings-reset-vulnerability-in-rank-math-seo/
CVE: CVE-2019-14788
Published: 2019-08-15
Description: wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://wordpress.org/plugins/newsletters-lite/#developers; https://wpvulndb.com/vulnerabilities/9447; https://www.pluginvulnerabilities.com/2019/07/02/there-is-also-an-authenticated-remote-code-execution-rce-vulnerability-in-newsletters/
CVE: CVE-2019-14789
Published: 2019-08-15
Description: The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/custom-404-pro/#developers; https://www.pluginvulnerabilities.com/2019/06/25/other-vulnerability-data-sources-miss-that-a-reflected-xss-vulnerability-in-custom-404-pro-hasnt-been-fixed/; https://wordpress.org/plugins/custom-404-pro/#developers
CVE: CVE-2017-14232
Published: 2019-08-15
Description: The read_chunk function in flif-dec.cpp in Free Lossless Image Format (FLIF) 0.3 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted flif file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-399
References: https://cxsecurity.com/cveshow/CVE-2017-14232; https://www.oracle.com/security-alerts/cpuapr2020.html; https://cxsecurity.com/cveshow/CVE-2017-14232
CVE: CVE-2018-12101
Published: 2019-08-15
Description: CMS Clipper 1.3.3 has XSS in the Security tab search, User Groups, Resource Groups, and User/Resource Group Links fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ClipperCMS/ClipperCMS/issues/487; https://github.com/ClipperCMS/ClipperCMS/issues/488; https://github.com/ClipperCMS/ClipperCMS/issues/496
CVE: CVE-2018-12357
Published: 2019-08-15
Description: Arista CloudVision Portal through 2018.1.1 has Incorrect Permissions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://www.arista.com/en/support/advisories-notices; https://www.arista.com/en/support/advisories-notices/security-advisories/5432-security-advisory-35; https://www.arista.com/en/support/advisories-notices
CVE: CVE-2018-14008
Published: 2019-08-15
Description: Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://www.arista.com/en/support/advisories-notices; https://www.arista.com/en/support/advisories-notices/security-advisories/6072-security-advisory-38; https://www.arista.com/en/support/advisories-notices
CVE: CVE-2018-17790
Published: 2019-08-15
Description: Prospecta Master Data Online (MDO) 2.0 has Stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154001/Master-Data-Online-2.0-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/cve/CVE-2018-17790; http://packetstormsecurity.com/files/154001/Master-Data-Online-2.0-Cross-Site-Scripting.html
CVE: CVE-2019-10140
Published: 2019-08-15
Description: A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs. An attacker with local access can create a denial of service situation via NULL pointer dereference in ovl_posix_acl_create function in fs/overlayfs/dir.c. This can allow attackers with ability to create directories on overlayfs to crash the kernel creating a denial of service (DOS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10140; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10140
CVE: CVE-2019-11187
Published: 2019-08-15
Description: Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/gonicus/gosa/commits/master; https://lists.debian.org/debian-lts-announce/2019/08/msg00009.html; https://github.com/gonicus/gosa/commits/master
CVE: CVE-2019-12854
Published: 2019-08-15
Description: Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html; http://www.squid-cache.org/Advisories/SQUID-2019_1.txt
CVE: CVE-2019-13217
Published: 2019-08-15
Description: A heap buffer overflow in the start_decoder function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://nothings.org/stb_vorbis/; https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6; https://github.com/nothings/stb/commits/master/stb_vorbis.c
CVE: CVE-2019-13218
Published: 2019-08-15
Description: Division by zero in the predict_point function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://nothings.org/stb_vorbis/; https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6; https://github.com/nothings/stb/commits/master/stb_vorbis.c
CVE: CVE-2019-13219
Published: 2019-08-15
Description: A NULL pointer dereference in the get_window function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://nothings.org/stb_vorbis/; https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6; https://github.com/nothings/stb/commits/master/stb_vorbis.c
CVE: CVE-2019-13220
Published: 2019-08-15
Description: Use of uninitialized stack variables in the start_decoder function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or disclose sensitive information by opening a crafted Ogg Vorbis file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-908
References: http://nothings.org/stb_vorbis/; https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6; https://github.com/nothings/stb/commits/master/stb_vorbis.c
CVE: CVE-2019-13221
Published: 2019-08-15
Description: A stack buffer overflow in the compute_codewords function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://nothings.org/stb_vorbis/; https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6; https://github.com/nothings/stb/commits/master/stb_vorbis.c
CVE: CVE-2019-13222
Published: 2019-08-15
Description: An out-of-bounds read of a global buffer in the draw_line function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or disclose sensitive information by opening a crafted Ogg Vorbis file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: http://nothings.org/stb_vorbis/; https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6; https://github.com/nothings/stb/commits/master/stb_vorbis.c
CVE: CVE-2019-13223
Published: 2019-08-15
Description: A reachable assertion in the lookup1_values function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: http://nothings.org/stb_vorbis/; https://github.com/nothings/stb/commit/98fdfc6df88b1e34a736d5e126e6c8139c8de1a6; https://github.com/nothings/stb/commits/master/stb_vorbis.c