Summary
It was discovered that AOM incorrectly handled certain inputs. If a user or an
automated system were tricked into opening a specially crafted input file, a
remote attacker could possibly use this issue to cause a denial of service.
(CVE-2020-36130, CVE-2020-36131, CVE-2020-36133, CVE-2020-36135,
CVE-2021-30473, CVE-2021-30474, CVE-2021-30475)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | aom | 1.0.0.errata1-3+deb11u1build0.20.04.1 |
Vulnerabilities 7
-
Unscored —
AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.
-
Unscored —
AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.
-
Unscored —
AOM v2.0.1 was discovered to contain a global buffer overflow via the component av1/encoder/partition_search.h.
-
Unscored —
AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.
-
Unscored —
aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.
-
Unscored —
aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
-
Unscored —
aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow.
References
-
report
https://ubuntu.com/security/CVE-2020-36130
-
report
https://ubuntu.com/security/CVE-2020-36131
-
report
https://ubuntu.com/security/CVE-2020-36133
-
report
https://ubuntu.com/security/CVE-2020-36135
-
report
https://ubuntu.com/security/CVE-2021-30473
-
report
https://ubuntu.com/security/CVE-2021-30474
-
report
https://ubuntu.com/security/CVE-2021-30475