whitelist-bypass

Whitelist Bypass Tunnels internet traffic through video calling platforms VK Call, Yandex Telemost, WB Stream to bypass government whitelist censorship. Setup Step-by-step setup guide in Russian: docs/SETUP.md How it works Two tunnel modes are available: DC DataChannel and Video VP8 data encoding...

cve-2023-5217-poc

CVE-2023-5217: libvpx VP8 Encoding Heap Overflow PoC CVE-2023-5217 is an in-the-wild exploited libvpx vulnerability that was found by Clément Lecigne of Google's Threat Analysis Group to be targeting Chrome. This repo shows how to trigger CVE-2023-5217 in the browser using the WebCodecs and...

platform_external_libvpx_v1.4.0_CVE-2023-5217

README - 23 March 2015 Welcome to the WebM VP8/VP9 Codec SDK! COMPILING THE APPLICATIONS/LIBRARIES: The build system used is similar to autotools. Building generally consists of "configuring" with your desired build options, then using GNU make to build the application. 1. Prerequisites All x86...

platform_external_libvpx_v1.8.0_CVE-2023-5217

README - 31 January 2019 Welcome to the WebM VP8/VP9 Codec SDK! COMPILING THE APPLICATIONS/LIBRARIES: The build system used is similar to autotools. Building generally consists of "configuring" with your desired build options, then using GNU make to build the application. 1. Prerequisites All x86...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Media: MediTech; vcodec: Fixed the VP8 stateless decoder’s “smatch” warning. A “smatch” static checker warning was also fixed in vdecvp8reqif.c. This issue causes the kernel to crash when fb is set to NULL...

CLEANSTART-2026-CU18243 webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size

CVE-2026-46601 affects multiple packages. The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size. See references for individual vulnerability details...

Rocky Linux 8 [CIQ] Security Update: libvpx-debuginfo / libvpx-debugsource Multiple Vulnerabilities (crlsa-2023_5537)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20235537 advisory. libvpx: Heap buffer overflow in vp8 encoding in libvpx CVE-2023-5217 libvpx: crash related to VP9 encoding in libvpx CVE-2023-44488 Tenable has extracted t...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, Chromium, and LibVpx

A heap buffer overflow occurred in the vp8 encoding process in libvpx within Google Chrome before version 117.0.5938.132. In version 1.13.1 of libvpx, a remote attacker could potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libvpx (UTSA-2023-003033)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003033 advisory. Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap...

Important: rclone

Issue Overview: The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size. CVE-2026-46601 The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause...

Linux Distros Unpatched Vulnerability : CVE-2026-46601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size. CVE-2026-46601 Note that Nessus relies on the presence...

CVE-2026-46601

A flaw was found in the golang.org/x/image/webp library's WebP decoder. A remote attacker could exploit this vulnerability by providing a specially crafted WebP image containing a VP8 chunk with mismatched dimensions. This could cause the decoder to panic, leading to a denial of service DoS for...

Uncaught Exception

Overview golang.org/x/image/webp is a Package webp implements a decoder for WEBP images. Affected versions of this package are vulnerable to Uncaught Exception in the webp decoder when processing a VP8 chunk with dimensions that do not match the canvas size. An attacker can cause a denial of...

CVE-2026-46601 Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size...

CVE-2026-46601

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size...

CVE-2026-46601

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size...

CVE-2026-46601

The webp decoder is vulnerable to a panic condition when processing a VP8 chunk where the dimensions do not match the canvas size. This vulnerability impacts multiple packages including mailpit (fixed in version 1.29.7-r1), ollama (fixed in versions 0.23.4-r2, 0.30.10-r0, 0.31.2-r2, 0.32.11-r3), ...

CVE-2026-46601: Undefined Security Weakness

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size...

GO-2026-5061 Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size...

OSV-2026-889 Use-of-uninitialized-value in vp8_compute_skin_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520701729 Crash type: Use-of-uninitialized-value Crash state: vp8computeskinblock encodeframetodatarate vp8getcompresseddata...