Summary
The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.
Security Fix(es):
* libvpx: Double free in ParseContentEncodingEntry() in mkvparser.cc (CVE-2019-2126)
* libvpx: Out of bounds read in vp8_norm table (CVE-2019-9232)
* libvpx: Resource exhaustion after memory leak in mkvparser.cc (CVE-2019-9371)
* libvpx: Use-after-free in vp8_deblock() in vp8/common/postproc.c (CVE-2019-9433)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | libvpx | 1.7.0-8.el8 |
| AlmaLinux · 8 | libvpx-devel | 1.7.0-8.el8 |
Vulnerabilities 4
-
Unscored —
In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer…
-
Unscored —
In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information …
-
Unscored —
In libvpx, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial o…
-
Unscored —
In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote infor…