Skip to content
OpenAdvisories
Medium RLSA-2024:9827 1 CVE

Moderate: libvpx security update

Published Mar 17, 2025 · Updated Oct 9, 2025

Ecosystem: Rocky Linux

Summary

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.

Security Fix(es):

* libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 libvpx 0:1.9.0-8.el9_5

Vulnerabilities 1

  • Medium 5.9
    CVE-2024-5197

    Integer overflow in libvpx

    There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the return…

    Chromium libvpx libvpx libvpx Debian Ubuntu Azure Linux Alpine

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2291198