Lucene search

K
rockyRockylinux Product ErrataRLSA-2024:5941
HistorySep 17, 2024 - 12:54 a.m.

libvpx security update

2024-09-1700:54:54
Rockylinux Product Errata
errata.rockylinux.org
1
libvpx
security update
rocky linux 8
heap buffer overflow
integer overflow
vp8 sdk
cve
cvss.

CVSS4

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

PASSIVE

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/SC:L/VI:H/SI:L/VA:N/SA:N

AI Score

7.3

Confidence

High

An update is available for libvpx.
This update affects Rocky Linux 8.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list
The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.

Security Fix(es):

  • libvpx: Heap buffer overflow related to VP9 encoding (CVE-2023-6349)

  • libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVSS4

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

PASSIVE

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/SC:L/VI:H/SI:L/VA:N/SA:N

AI Score

7.3

Confidence

High