USN-6814-1: libvpx vulnerability
Xiantong Hou discovered that libvpx did not properly handle certain malformed media files. If an application using libvpx opened a specially crafted file, a remote attacker could cause a denial of service, or possibly execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libvpx9to a version that resolves this vulnerability.Fixed in 1.14.0-1ubuntu2.1 - Upgrade
Upgrade
ubuntu/libvpx7to a version that resolves this vulnerability.Fixed in 1.12.0-1ubuntu2.1 - Upgrade
Upgrade
ubuntu/libvpx7to a version that resolves this vulnerability.Fixed in 1.11.0-2ubuntu2.3 - Upgrade
Upgrade
ubuntu/libvpx6to a version that resolves this vulnerability.Fixed in 1.8.2-1ubuntu0.3
Event History
Frequently Asked Questions
What is the severity of USN-6814-1?
USN-6814-1 is marked as critical due to the potential for remote code execution and denial of service.
How do I fix USN-6814-1?
To fix USN-6814-1, upgrade to the patched version of libvpx specified for your Ubuntu release.
Which versions of libvpx are affected by USN-6814-1?
USN-6814-1 affects libvpx versions prior to 1.14.0-1ubuntu2.1, 1.12.0-1ubuntu2.1, 1.11.0-2ubuntu2.3, and 1.8.2-1ubuntu0.3.
What are the potential risks of not addressing USN-6814-1?
Not addressing USN-6814-1 exposes systems to possible remote code execution and denial of service attacks.
Who discovered the vulnerability described in USN-6814-1?
The vulnerability described in USN-6814-1 was discovered by Xiantong Hou.