CVE-2024-5197 Integer overflow in libvpx

2024-06-0313:30:26

CWE-190

Google

github.com

cve-2024-5197

libvpx

integer overflow

5.9 Medium

CVSS4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

PASSIVE

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/SC:L/VI:H/SI:L/VA:N/SA:N

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.2%

JSON

There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond

CNA Affected

[
  {
    "repo": "https://chromium.googlesource.com",
    "vendor": "Chromium",
    "product": "libvpx",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.14.1",
        "versionType": "semver"
      }
    ],
    "packageName": "libvpx",
    "programFiles": [
      "https://chromium.googlesource.com/webm/libvpx/+/refs/heads/main/vpx/src/vpx_image.c"
    ],
    "collectionURL": "https://chromium.googlesource.com/webm/",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "vpx_img_alloc()"
      },
      {
        "name": "vpx_img_wrap()"
      }
    ]
  }
]