Summary
The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.
Security Fix(es):
* libvpx: Heap buffer overflow related to VP9 encoding (CVE-2023-6349)
* libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | libvpx | 1.7.0-11.el8_10 |
| AlmaLinux · 8 | libvpx-devel | 1.7.0-11.el8_10 |
Vulnerabilities 2
-
Medium 5.9
Integer overflow in libvpx
There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the return…
-
Medium 5.7
Heap overflow in libvpx
A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above