Description
WebM libvpx (aka the VP8 Codec SDK) before 0.9.5, as used in Google Chrome before 7.0.517.44, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via invalid frames.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libvpx | 0.9.1-2 | — |
| Debian 13 | libvpx | 0.9.1-2 | — |
| Debian 12 | libvpx | 0.9.1-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | libvpx +2 | 0.9.0-8.el6_0 | RHSA-2010:0999 |
Advisories 1
- RHSA-2010:0999 Red Hat Security Advisory: libvpx security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 42690 third-party-advisory
- oval:org.mitre.oval:def:12198 vdb-entry signature
- http://googlechromereleases.blogspot.com/2010/11/stable-channel-update.html
- GLSA-201101-03 vendor-advisory
- RHSA-2010:0999 vendor-advisory
- 42109 third-party-advisory
- http://review.webmproject.org/gitweb?p=libvpx.git%3Ba=blob%3Bf=CHANGELOG
- http://code.google.com/p/chromium/issues/detail?id=60055
- 42118 third-party-advisory
- ADV-2011-0115 vdb-entry
- http://review.webmproject.org/gitweb?p=libvpx.git%3Ba=commit%3Bh=09bcc1f710ea65dc158639479288fb1908ff0c53
- 42908 third-party-advisory