MGASA-2024-0221

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2024-0221.html
Import Source
https://advisories.mageia.org/MGASA-2024-0221.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2024-0221
Upstream
Published
2024-06-14T17:30:25Z
Modified
2026-04-16T04:44:40Z
Summary
Updated libvpx packages fix security vulnerabilities
Details

There exists integer overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. (CVE-2024-5197)

References
Credits

Affected packages

Mageia:9 / libvpx

Package

Name
libvpx
Purl
pkg:rpm/mageia/libvpx?arch=source&distro=mageia-9

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.12.0-1.3.mga9

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2024-0221.json"