Veracode Vulnerability DatabaseVERACODE:25961Denial Of Service (DoS)
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
7.1 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:N/I:N/A:C
libvpx.so is vulnerable to denial of service (DoS). The vulnerability exists because of lack of proper validation of input parameters in mkvparser.cc, leading to a resource consumption and application crash.
| CPE | Name | Operator | Version |
|---|---|---|---|
| libvpx.so | le | 6.3.0 | |
| libvpx | eq | 1.7.0__6.el8 | |
| libvpx.so | le | 6.3.0 | |
| libvpx | eq | 1.7.0__6.el8 |
References
lists.opensuse.org/opensuse-security-announce/2020-01/msg00049.html
www.openwall.com/lists/oss-security/2019/10/25/17
www.openwall.com/lists/oss-security/2019/10/27/1
www.openwall.com/lists/oss-security/2019/11/07/1
lists.fedoraproject.org/archives/list/[email protected]/message/DQSTK442ATWJOR4TU3MR6C3N5A6NDFFN/
lists.fedoraproject.org/archives/list/[email protected]/message/U2IIA3RSYABBUCFIHXIRVUT5CTJVWWZ6/
seclists.org/bugtraq/2019/Nov/43
security.gentoo.org/glsa/202003-59
source.android.com/security/bulletin/android-10
usn.ubuntu.com/4199-1/
www.debian.org/security/2019/dsa-4578
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
7.1 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:N/I:N/A:C