Skip to content
OpenAdvisories
High 1 exploited CVE USN-7172-1 1 CVE

libvpx vulnerability

Published Dec 18, 2024 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that libvpx did not properly handle certain malformed
media files. If an application using libvpx opened a specially crafted
file, a remote attacker could cause a denial of service, or possibly
execute arbitrary code. Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04
LTS, and Ubuntu 16.04 LTS were previously addressed in USN-6403-1,
USN-6403-2, and USN-6403-3. This update addresses the issue in Ubuntu 14.04
LTS.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS libvpx 1.3.0-2ubuntu0.1~esm3

Vulnerabilities 1

  • High 8.8
    CVE-2023-5217 Exploited Public exploit EPSS 49%

    Electron affected by libvpx's heap buffer overflow in vp8 encoding

    Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    Google Chrome libvpx chromium Browsers Debian Ubuntu Alpine npm
    KEV Oct 2, 2023

References

  • report
    https://ubuntu.com/security/CVE-2023-5217