ELSA-2023-5537 — Important: libvpx security update (Oracle Linux 8)

Summary

[1.7.0-10]
- Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)
Resolves: rhbz#2241191
- crash related to VP9 encoding in libvpx (CVE-2023-44488)
Resolves: rhbz#2241806

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 8	libvpx	0:1.7.0-10.el8_8
Oracle Linux · 8	libvpx-devel	0:1.7.0-10.el8_8

Vulnerabilities 2

High 8.8

CVE-2023-5217 Exploited Public exploit EPSS 49%

Electron affected by libvpx's heap buffer overflow in vp8 encoding

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Google Chrome libvpx chromium Browsers Debian Ubuntu Alpine npm

Sep 28, 2023
KEV Oct 2, 2023
Unscored —

CVE-2023-44488

VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding.

mozjs38 mozjs52 mozjs68 mozjs78 Debian Ubuntu Azure Linux

Sep 30, 2023

Important: libvpx security update (Oracle Linux 8)

Summary

Fixed packages 2

Vulnerabilities 2

Electron affected by libvpx's heap buffer overflow in vp8 encoding

VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding.