Lucene search

K
redhatRedHatRHSA-2024:5941
HistoryAug 28, 2024 - 3:26 p.m.

(RHSA-2024:5941) Moderate: libvpx security update

2024-08-2815:26:38
access.redhat.com
9
libvpx
security update
vp8
vp9
buffer overflow
integer overflow

CVSS4

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

PASSIVE

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/SC:L/VI:H/SI:L/VA:N/SA:N

AI Score

7.3

Confidence

High

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.

Security Fix(es):

  • libvpx: Heap buffer overflow related to VP9 encoding (CVE-2023-6349)

  • libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVSS4

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

PASSIVE

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/SC:L/VI:H/SI:L/VA:N/SA:N

AI Score

7.3

Confidence

High