Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-5197: There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libvpx | 0:1.9.0-5.amzn2.0.4 |
| Amazon Linux · 2 | libvpx-debuginfo | 0:1.9.0-5.amzn2.0.4 |
| Amazon Linux · 2 | libvpx-devel | 0:1.9.0-5.amzn2.0.4 |
| Amazon Linux · 2 | libvpx-utils | 0:1.9.0-5.amzn2.0.4 |
Vulnerabilities 1
-
Medium 5.9
Integer overflow in libvpx
There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the return…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-5197.html