Unrated severityNVD Advisory· Published Jun 3, 2024· Updated Feb 13, 2025
Integer overflow in libvpx
CVE-2024-5197
Description
There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond
Affected products
26- Range: <1.14.1
- osv-coords24 versionspkg:rpm/almalinux/libvpxpkg:rpm/almalinux/libvpx-develpkg:rpm/opensuse/libvpx&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/libvpx&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/libvpx&distro=openSUSE%20Tumbleweedpkg:rpm/suse/libvpx&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/libvpx&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/libvpx&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/libvpx&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOSpkg:rpm/suse/libvpx&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSSpkg:rpm/suse/libvpx&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP5pkg:rpm/suse/libvpx&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6pkg:rpm/suse/libvpx&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP5pkg:rpm/suse/libvpx&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP6pkg:rpm/suse/libvpx&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP5pkg:rpm/suse/libvpx&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6pkg:rpm/suse/libvpx&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/libvpx&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/libvpx&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSSpkg:rpm/suse/libvpx&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/libvpx&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/libvpx&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4pkg:rpm/suse/libvpx&distro=SUSE%20Manager%20Proxy%204.3pkg:rpm/suse/libvpx&distro=SUSE%20Manager%20Server%204.3
< 1.7.0-11.el8_10+ 23 more
- (no CPE)range: < 1.7.0-11.el8_10
- (no CPE)range: < 1.7.0-11.el8_10
- (no CPE)range: < 1.11.0-150400.3.7.1
- (no CPE)range: < 1.11.0-150400.3.7.1
- (no CPE)range: < 1.14.1-1.1
- (no CPE)range: < 1.6.1-150000.6.16.1
- (no CPE)range: < 1.6.1-150000.6.16.1
- (no CPE)range: < 1.6.1-150000.6.16.1
- (no CPE)range: < 1.11.0-150400.3.7.1
- (no CPE)range: < 1.11.0-150400.3.7.1
- (no CPE)range: < 1.11.0-150400.3.7.1
- (no CPE)range: < 1.11.0-150400.3.7.1
- (no CPE)range: < 1.6.1-150000.6.16.1
- (no CPE)range: < 1.6.1-150000.6.16.1
- (no CPE)range: < 1.11.0-150400.3.7.1
- (no CPE)range: < 1.11.0-150400.3.7.1
- (no CPE)range: < 1.6.1-150000.6.16.1
- (no CPE)range: < 1.6.1-150000.6.16.1
- (no CPE)range: < 1.11.0-150400.3.7.1
- (no CPE)range: < 1.6.1-150000.6.16.1
- (no CPE)range: < 1.6.1-150000.6.16.1
- (no CPE)range: < 1.11.0-150400.3.7.1
- (no CPE)range: < 1.11.0-150400.3.7.1
- (no CPE)range: < 1.11.0-150400.3.7.1
- Chromium/libvpxv5Range: 0
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.