Skip to content
OpenAdvisories
Medium ELSA-2024-5941 2 CVEs

Moderate: libvpx security update (Oracle Linux 8)

Published Aug 28, 2024 · Updated Aug 28, 2024

Ecosystem: Oracle Linux

Summary

[1.7.0-11]
- Add patch to fix integer overflows.
- Fix compilation by including limits.h
- Resolves: RHEL-40650

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 8 libvpx 0:1.7.0-11.el8_10
Oracle Linux · 8 libvpx-devel 0:1.7.0-11.el8_10

Vulnerabilities 2

  • Medium 5.9
    CVE-2024-5197

    Integer overflow in libvpx

    There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the return…

    Chromium libvpx libvpx libvpx Debian Ubuntu Azure Linux Alpine
  • Medium 5.7
    CVE-2023-6349

    Heap overflow in libvpx

    A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above

    Chromium libvpx libvpx libvpx Debian Ubuntu