Skip to content
OpenAdvisories
Medium USN-6814-1 1 CVE

libvpx vulnerability

Published Jun 6, 2024 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Xiantong Hou discovered that libvpx did not properly handle certain
malformed media files. If an application using libvpx opened a specially
crafted file, a remote attacker could cause a denial of service, or
possibly execute arbitrary code.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS libvpx 1.8.2-1ubuntu0.3
Ubuntu · 22.04 LTS 22.04:LTS libvpx 1.11.0-2ubuntu2.3
Ubuntu · 24.04 LTS 24.04:LTS libvpx 1.14.0-1ubuntu2.1

Vulnerabilities 1

  • Medium 5.9
    CVE-2024-5197

    Integer overflow in libvpx

    There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the return…

    Chromium libvpx libvpx libvpx Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2024-5197