Description
A denial of service vulnerability in libvpx in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-30436808.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Android | Android-4.4.4, Android-5.0.2, Android-5.1.1, Android-6.0, Android-6.0.1, Android-7.0, Android-7.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libvpx | 1.6.1-1 | — |
| Debian 13 | libvpx | 1.6.1-1 | — |
| Debian 12 | libvpx | 1.6.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | android | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | libvpx +2 | 1.3.0-8.el7 | RHSA-2020:3876 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | libvpx +2 | 1.3.0-8.amzn2.0.1 | ALAS2-2020-1558 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | libvpx +2 | 1.3.0-8.el7 | ELSA-2020-3876 |
Advisories 3
- RHSA-2020:3876 Red Hat Security Advisory: libvpx security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- ALAS2-2020-1558 Moderate: libvpx security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 11, 2020
- ELSA-2020-3876 Moderate: libvpx security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 6, 2020