Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-6349: A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above CVE-2023-44488: VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libvpx | 0:1.9.0-5.amzn2.0.3 |
| Amazon Linux · 2 | libvpx-debuginfo | 0:1.9.0-5.amzn2.0.3 |
| Amazon Linux · 2 | libvpx-devel | 0:1.9.0-5.amzn2.0.3 |
| Amazon Linux · 2 | libvpx-utils | 0:1.9.0-5.amzn2.0.3 |
Vulnerabilities 2
-
Medium 5.7
Heap overflow in libvpx
A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above
-
Unscored —
VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding.