Lucene search

K
gentooGentoo FoundationGLSA-202310-04
HistoryOct 04, 2023 - 12:00 a.m.

libvpx: Multiple Vulnerabilities

2023-10-0400:00:00
Gentoo Foundation
security.gentoo.org
26
libvpx
vp8 codec
video streams
webm format
cve identifiers
upgrade
media-libs

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.248

Percentile

96.7%

Background

libvpx is the VP8 codec SDK used to encode and decode video streams, typically within a WebM format media file.

Description

Multiple vulnerabilities have been discovered in libvpx. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All libvpx users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=media-libs/libvpx-1.13.1"
OSVersionArchitecturePackageVersionFilename
Gentooanyallmedia-libs/libvpx<Β 1.13.1UNKNOWN

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.248

Percentile

96.7%