Important: libvpx security update
Summary
ALSA-2023:5537: Important: libvpx security update. Affects libvpx versions < 1.7.0-10.el8_8.alma.1. Fixed in 1.7.0-10.el8_8.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libvpx package provides the VP8 SDK, which enables the encoding and decoding of the VP8 video codec. VP8 is commonly used with the WebM multimedia container file format. The package is widely utilized in various applications and platforms for video encoding and decoding purposes.
Vulnerability Detail
The libvpx package is affected by two security vulnerabilities:
-
Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217): This vulnerability allows an attacker to overflow a heap buffer during the vp8 encoding process, potentially leading to remote code execution or denial of service.
-
Crash related to VP9 encoding in libvpx (CVE-2023-44488): This vulnerability can cause a crash in the libvpx library when encoding VP9 video, potentially resulting in a denial of service.
Both vulnerabilities pose a significant risk to systems utilizing libvpx for video encoding and decoding.
How To Fix
Minimum fixed version
1.7.0-10.el8_8.alma.1
This is the first release that contains the fix.
sudo dnf update libvpxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is crucial to update the libvpx package to the recommended version or later to address the identified vulnerabilities. Failure to do so may expose systems to potential remote code execution, denial of service, or crashes. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libvpx →
FAQ
libvpx is a library that provides the VP8 SDK, allowing the encoding and decoding of the VP8 video codec commonly used with the WebM multimedia container file format.
These vulnerabilities can potentially lead to remote code execution, denial of service, or crashes in systems utilizing libvpx for video encoding and decoding.
No, only versions prior to 1.7.0-10.el8_8.alma.1 are affected. It is recommended to update to the latest version to mitigate the vulnerabilities.
No specific workaround has been provided for these vulnerabilities. It is recommended to update to the latest version of libvpx as soon as possible.
You can find more information about these vulnerabilities, including their impact, CVSS scores, acknowledgments, and related details, on the CVE pages: CVE-2023-5217 and CVE-2023-44488.
Related vulnerabilities
Recent vulnerabilities recorded for libvpx.
