Denial of Service Vulnerability in libvpx: Buffer Over-read Risk
Summary
CVE-2016-3881: The decoder_peek_si_internal function in vp9/vp9_dx_iface.c in libvpx in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows remote att... Affects libvpx versions < 1.6.1-1. Fixed in 1.6.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvpx is an open-source video codec library developed by Google, primarily used for encoding and decoding VP8 and VP9 video formats. It is widely utilized in various multimedia applications and services. The library is designed to provide high-quality video compression while maintaining low latency. However, certain versions of libvpx contain a vulnerability that allows remote attackers to exploit crafted media files, leading to potential denial of service scenarios.
Vulnerability Detail
The vulnerability, identified as CVE-2016-3881, resides in the decoder_peek_si_internal function within the vp9/vp9_dx_iface.c file of libvpx. It affects Android versions 4.x through 7.0 prior to September 2016. By sending specially crafted media files to the affected system, an attacker can trigger a buffer over-read, which may cause the device to hang or reboot unexpectedly. This vulnerability poses a significant risk as it can disrupt service availability and affect user experience.
How To Fix
Minimum fixed version
1.6.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libvpxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict the types of media files that can be processed by the application using libvpx. Implementing strict validation checks on incoming media files can help mitigate the risk of exploitation until the library is updated.
Conclusion
CVE-2016-3881 is a significant vulnerability in the libvpx library that can lead to denial of service through crafted media files. Users are advised to upgrade to the latest version to mitigate risks. Additionally, employing strict validation on media files can serve as a temporary workaround.
See every vulnerability recorded for libvpx →
FAQ
CVE-2016-3881 is a vulnerability in the libvpx library that allows remote attackers to cause a denial of service through crafted media files.
Affected versions include libvpx in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before September 1, 2016, and 7.0 before September 1, 2016.
The vulnerability can lead to a denial of service, causing the device to hang or reboot unexpectedly, which disrupts service availability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 5.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for libvpx.
