Moderate: libvpx security update
Summary
ALSA-2024:5941: Moderate: libvpx security update. Affects libvpx versions < 1.7.0-11.el8_10. Fixed in 1.7.0-11.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. This vulnerability affects the libvpx package in AlmaLinux 8.
Vulnerability Detail
The vulnerability in libvpx includes two security issues:
-
Heap buffer overflow related to VP9 encoding (CVE-2023-6349): This vulnerability allows an attacker to overflow a heap buffer during VP9 encoding, potentially leading to remote code execution or denial of service.
-
Integer overflow in vpx_img_alloc() (CVE-2024-5197): An integer overflow in the vpx_img_alloc() function can result in a buffer overflow, which may allow an attacker to execute arbitrary code or cause a denial of service.
These vulnerabilities can be exploited by an attacker to compromise the affected system, potentially leading to unauthorized access, data loss, or system disruption.
How To Fix
Minimum fixed version
1.7.0-11.el8_10
This is the first release that contains the fix.
sudo dnf update libvpxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The libvpx package in AlmaLinux 8 is vulnerable to two security issues: a heap buffer overflow related to VP9 encoding and an integer overflow in vpx_img_alloc(). These vulnerabilities can be exploited by attackers to compromise the system and potentially cause unauthorized access, data loss, or system disruption. It is crucial to update the libvpx package to version 1.7.0-11.el8_10 or later to mitigate these vulnerabilities.
See every vulnerability recorded for libvpx →
FAQ
libvpx is a library that provides the VP8 SDK, enabling the encoding and decoding of the VP8 video codec. It is commonly used with the WebM multimedia container file format.
These vulnerabilities can be exploited by an attacker to compromise the affected system, potentially leading to unauthorized access, data loss, or system disruption.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you in real-time if your application is affected.
At the moment, there are no known workarounds for these vulnerabilities. It is recommended to update the libvpx package to the latest version.
You can find more information about these vulnerabilities, including their impact, CVSS scores, acknowledgments, and related details, on the CVE pages: CVE-2023-6349 and CVE-2024-5197.
Related vulnerabilities
Recent vulnerabilities recorded for libvpx.
