Most recent entries from all

ALSA-2024:5941 — Moderate: libvpx security update

Affected: AlmaLinux:8: libvpx, AlmaLinux:8: libvpx-devel

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.

Security Fix(es):

* libvpx: Heap buffer overflow related to VP9 encoding (CVE-2023-6349) * libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-05778

certfr-2024-avi-0903 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2024-avi-0903

EUVD-2026-7664

fkie_cve-2023-6349

A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above

gsd-2023-6349

msrc_CVE-2023-6349 — Heap overflow in libvpx

msrc_CVE-2023-6349

RHSA-2024:5941 — Red Hat Security Advisory: libvpx security update

libvpx: Heap buffer overflow related to VP9 encoding libvpx: Integer overflow in vpx_img_alloc()

RHSA-2026:4128 — Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)

giflib: out-of-bounds read in DumpScreen2RGB() in gif2rgb.c in gif2rgb tool golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service kernel: insufficient TCP source port randomness leads to client identification libvpx: Heap buffer overflow related to VP9 encoding openjpeg: Malicious files can cause the program to enter a large loop openjpeg: Resource exhaustion will occur in the opj_t1_decode_cblks function in the tcd.c golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints libsndfile: Reachable assertion in mpeg_l3_encoder_close pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image

UBUNTU-CVE-2023-6349

Affected: Ubuntu:Pro:14.04:LTS: libvpx, Ubuntu:Pro:16.04:LTS: libvpx, Ubuntu:Pro:18.04:LTS: libvpx, Ubuntu:20.04:LTS: libvpx, Ubuntu:22.04:LTS: libvpx

WID-SEC-W-2024-1945 — Red Hat Enterprise Linux (libvpx): Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in der Komponente libvpx ausnutzen, um einen Denial of Service Angriff durchzuführen.