Skip to content
OpenAdvisories
Medium ALAS2-2025-3015 1 CVE

Moderate: libvpx security update (Amazon Linux 2)

Published Sep 23, 2025 · Updated Sep 29, 2025

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-5197: There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 libvpx 0:1.9.0-5.amzn2.0.4
Amazon Linux · 2 libvpx-debuginfo 0:1.9.0-5.amzn2.0.4
Amazon Linux · 2 libvpx-devel 0:1.9.0-5.amzn2.0.4
Amazon Linux · 2 libvpx-utils 0:1.9.0-5.amzn2.0.4

Vulnerabilities 1

  • Medium 5.9

    Integer overflow in libvpx

    There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the return…

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-5197.html