DSA-5510: -1 libvpx -- security update

Published Sep 29, 2023

Updated

Clement Lecigne discovered a heap-based buffer overflow in libvpx, a multimedia library for the VP8 and VP9 video codecs, which may result in the execution of arbitrary code if a specially crafted VP8 media stream is processed.

Affected Software

2 affected componentsFixes available

debian/libvpx

1.12.0-1+deb12u5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/libvpx to a version that resolves this vulnerability.
Fixed in 1.12.0-1+deb12u5
Upgrade
Upgrade libvpx to a version that resolves this vulnerability.
Patch DSA-5510-1

Event History

Sep 29, 2023

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2023-5217

Frequently Asked Questions

What is the vulnerability ID for this security update?

The vulnerability ID for this security update is DSA-5510.

What is the title of this security update?

The title of this security update is DSA-5510-1 libvpx -- security update.

Who discovered the vulnerability?

The vulnerability was discovered by Clement Lecigne.

What is libvpx?

libvpx is a multimedia library for the VP8 and VP9 video codecs.

What is the impact of the vulnerability?

The vulnerability can result in the execution of arbitrary code if a specially crafted VP8 media stream is processed.

What is the Common Weakness Enumeration (CWE) ID for this vulnerability?

The CWE ID for this vulnerability is CWE-119.

How can I fix this vulnerability?

To fix this vulnerability, you should update the libvpx package to the latest version.

Where can I find more information about this security update?

More information about this security update can be found at the following links: - [Debian Bug Report](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1053182) - [Debian Security Tracker](https://security-tracker.debian.org/tracker/CVE-2023-5217) - [Debian Security Advisory](https://www.debian.org/security/2023/dsa-5510)