Check failed in CheckUnwind in libvpx
Summary
OSV-2022-533: Check failed in CheckUnwind. Affects libvpx versions >= 5b530fc962bcb8a51bbf03f5fbc2912f21b86e70, < 933b6b90a583b593efd8acb644603ab189226309. Fixed in 933b6b90a583b593efd8acb644603ab189226309. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvpx is an open-source library for encoding and decoding video streams. It is widely used in various applications and platforms to handle video compression and decompression. This vulnerability affects the libvpx package and can potentially lead to a crash or other unexpected behavior in applications that utilize this library.
Vulnerability Detail
The vulnerability, identified as OSV-2022-533, originates from a check failure in the CheckUnwind function of libvpx. This issue was discovered through the OSS-Fuzz project, and the specific crash state involves the vp9_loop_filter_dealloc and vp9_decoder_remove functions. The impact of this vulnerability can vary depending on the context in which libvpx is used, but it may result in denial of service, information disclosure, or the execution of arbitrary code.
How To Fix
Minimum fixed version
933b6b90a583b593efd8acb644603ab189226309
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At the moment, there is no known workaround for this vulnerability. It is crucial to apply the fix provided by the libvpx project to address the issue effectively.
Conclusion
In conclusion, the CheckUnwind vulnerability in libvpx can lead to crashes or other unexpected behavior in applications that use this library. It is crucial to update to a fixed version of libvpx to mitigate the risk. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libvpx →
FAQ
libvpx is an open-source library used for video encoding and decoding.
The impact can vary, but it may lead to crashes, information disclosure, or arbitrary code execution.
This vulnerability was discovered through the OSS-Fuzz project.
No, there is currently no known workaround. Applying the provided fix is recommended.
The fix can be found in commit 933b6b90a583b593efd8acb644603ab189226309 of the libvpx repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for libvpx.
