Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux libvpx may cause crashes and security breach
published 3 years ago
Summary
The libvpx library used for VP8/VP9 video processing in AlmaLinux can overflow memory when encoding video, which could let an attacker cause a program crash or potentially execute unwanted code. This affects both the standard libvpx package and its development version. Update the libvpx packages to the latest version provided by AlmaLinux as soon as possible to protect your systems.
What to do
- Update almalinux libvpx to version 1.7.0-10.el8_8.alma.1.
- Update almalinux libvpx-devel to version 1.7.0-10.el8_8.alma.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | libvpx |
< 1.7.0-10.el8_8.alma.1 Fix: upgrade to 1.7.0-10.el8_8.alma.1
|
| AlmaLinux:8 | almalinux | libvpx-devel |
< 1.7.0-10.el8_8.alma.1 Fix: upgrade to 1.7.0-10.el8_8.alma.1
|
Original advisory text
Important: libvpx security update
The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.
Security Fix(es):
* libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)
* libvpx: crash related to VP9 encoding in libvpx (CVE-2023-44488)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)
* libvpx: crash related to VP9 encoding in libvpx (CVE-2023-44488)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2023:5537 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-44488 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-5217 Third Party Advisory
- https://bugzilla.redhat.com/2241191 Third Party Advisory
- https://bugzilla.redhat.com/2241806 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2023-5537.html Vendor Advisory
Timeline
Published9 Oct 2023
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2023:5537 · OSV
Track software like this
Free during beta