PatchTheCVElibvpx vulnerabilities and fixes
Recent CVEs affecting libvpx, with upgrade or downgrade steps. 3 tracked.
libvpx has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2024-06-03. Highest priority: CVE-2024-5197 (score 61/100).
- CVE-2024-5197 CRITICAL 9.1 UPGRADE MITIGATE There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large va
- CVE-2023-6349 HIGH 7.5 UPGRADE A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the original
- CVE-2023-44488 HIGH 7.5 UPGRADE MITIGATE VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding.
FAQ
How do I fix libvpx vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libvpx being exploited right now?
None of the tracked libvpx CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libvpx CVE should I patch first?
CVE-2024-5197 currently ranks highest (61/100): There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large va.