Skip to content
OpenAdvisories
Medium RHSA-2024:5941 2 CVEs

Red Hat Security Advisory: libvpx security update

Published Sep 16, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream libvpx 0:1.7.0-11.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream libvpx-debuginfo 0:1.7.0-11.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream libvpx-debugsource 0:1.7.0-11.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream libvpx-utils-debuginfo 0:1.7.0-11.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb libvpx-debuginfo 0:1.7.0-11.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb libvpx-debugsource 0:1.7.0-11.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb libvpx-devel 0:1.7.0-11.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb libvpx-utils-debuginfo 0:1.7.0-11.el8_10

Vulnerabilities 2

  • Medium 5.9
    CVE-2024-5197

    Integer overflow in libvpx

    There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the return…

    Chromium libvpx libvpx libvpx Debian Ubuntu Azure Linux Alpine
  • Medium 5.7
    CVE-2023-6349

    Heap overflow in libvpx

    A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above

    Chromium libvpx libvpx libvpx Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2283553
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2291198
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5941.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-6349
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-6349
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-6349
  • report
    https://access.redhat.com/security/cve/CVE-2024-5197
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-5197
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-5197