Debian Security Bug TrackerDEBIANCVE:CVE-2024-5197CVE-2024-5197
5.9 Medium
CVSS4
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
PASSIVE
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/SC:L/VI:H/SI:L/VA:N/SA:N
6.7 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.1%
There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | libvpx | <= 1.12.0-1+deb12u2 | libvpx_1.12.0-1+deb12u2_all.deb |
| Debian | 11 | all | libvpx | <= 1.9.0-1+deb11u2 | libvpx_1.9.0-1+deb11u2_all.deb |
| Debian | 10 | all | libvpx | < 1.7.0-3+deb10u3 | libvpx_1.7.0-3+deb10u3_all.deb |
| Debian | 999 | all | libvpx | < 1.14.1-1 | libvpx_1.14.1-1_all.deb |
| Debian | 13 | all | libvpx | < 1.14.1-1 | libvpx_1.14.1-1_all.deb |
Related
5.9 Medium
CVSS4
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
PASSIVE
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/SC:L/VI:H/SI:L/VA:N/SA:N
6.7 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.1%