UBUNTU-CVE-2024-5197

See a problem?

Source

https://ubuntu.com/security/notices/UBUNTU-CVE-2024-5197

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-5197.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2024-5197

Related

Published

2024-06-03T14:15:00Z

Modified

2024-06-03T14:15:00Z

Summary

[none]

Details

There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpximgalloc() with a large value of the dw, dh, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpximaget struct may be invalid. Calling vpximgwrap() with a large value of the dw, dh, or stridealign parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpximage_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond

References

Affected packages

Ubuntu:Pro:14.04:LTS / libvpx

Package

Name: libvpx

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.2.0-2

1.3.0-1

1.3.0-2

1.3.0-2ubuntu0.1~esm1

1.3.0-2ubuntu0.1~esm2

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:16.04:LTS / libvpx

Package

Name: libvpx

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.4.0-4

1.5.0-2

1.5.0-2ubuntu1

1.5.0-2ubuntu1.1

1.5.0-2ubuntu1.1+esm1

1.5.0-2ubuntu1.1+esm2

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / libvpx

Package

Name: libvpx

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.6.1-3

1.7.0-3

1.7.0-3ubuntu0.18.04.1

1.7.0-3ubuntu0.18.04.1+esm1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / libvpx

Package

Name: libvpx
Purl: pkg:deb/ubuntu/libvpx@1.8.2-1ubuntu0.3?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.2-1ubuntu0.3

Affected versions

1.*

1.8.1-2

1.8.2-1

1.8.2-1build1

1.8.2-1ubuntu0.2

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libvpx6": "1.8.2-1ubuntu0.3",
            "vpx-tools-dbgsym": "1.8.2-1ubuntu0.3",
            "vpx-tools": "1.8.2-1ubuntu0.3",
            "libvpx6-dbgsym": "1.8.2-1ubuntu0.3",
            "libvpx-doc": "1.8.2-1ubuntu0.3",
            "libvpx-dev": "1.8.2-1ubuntu0.3"
        }
    ]
}

Ubuntu:22.04:LTS / libvpx

Package

Name: libvpx
Purl: pkg:deb/ubuntu/libvpx@1.11.0-2ubuntu2.3?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.0-2ubuntu2.3

Affected versions

1.*

1.9.0-1ubuntu1

1.11.0-2ubuntu1

1.11.0-2ubuntu2

1.11.0-2ubuntu2.2

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "vpx-tools-dbgsym": "1.11.0-2ubuntu2.3",
            "libvpx7": "1.11.0-2ubuntu2.3",
            "vpx-tools": "1.11.0-2ubuntu2.3",
            "libvpx-doc": "1.11.0-2ubuntu2.3",
            "libvpx-dev": "1.11.0-2ubuntu2.3",
            "libvpx7-dbgsym": "1.11.0-2ubuntu2.3"
        }
    ]
}

Ubuntu:24.04:LTS / libvpx

Package

Name: libvpx
Purl: pkg:deb/ubuntu/libvpx@1.14.0-1ubuntu2.1?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.14.0-1ubuntu2.1

Affected versions

1.*

1.12.0-1ubuntu2

1.13.1-2ubuntu1

1.14.0-1ubuntu1

1.14.0-1ubuntu2

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libvpx9": "1.14.0-1ubuntu2.1",
            "vpx-tools-dbgsym": "1.14.0-1ubuntu2.1",
            "libvpx9-dbgsym": "1.14.0-1ubuntu2.1",
            "vpx-tools": "1.14.0-1ubuntu2.1",
            "libvpx-doc": "1.14.0-1ubuntu2.1",
            "libvpx-dev": "1.14.0-1ubuntu2.1"
        }
    ]
}