ECHO-f542-a708-8974
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-f542-a708-8974.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/ECHO-f542-a708-8974
- Upstream
- Withdrawn
- 2026-03-17T12:30:04Z
- Published
- 2026-03-17T12:30:04Z
- Modified
- 2026-09-15T00:47:47Z
- Summary
- Heap buffer overflow in libvpx. Debian's firefox-esr links against the system libvpx (libvpx9), not the bundled copy in the source tree. The system libvpx in trixie (1.15.0-2.1+deb13u1) already includes the fix via DSA-6143-1. The Debian security tracker even notes: "Firefox, Firefox ESR and Thunderbird use the system libvpx library". https://security-tracker.debian.org/tracker/CVE-2026-2447
- Details
- References
-
- https://advisory.echohq.com/cve/CVE-2026-2447
- https://nvd.nist.gov/vuln/detail/CVE-2026-2447
- https://bugzilla.mozilla.org/show_bug.cgi?id=2014390
- https://www.mozilla.org/security/advisories/mfsa2026-10/
- https://www.mozilla.org/security/advisories/mfsa2026-11/
- https://lists.debian.org/debian-lts-announce/2026/02/msg00028.html