Multiple security issues were found in libvpx multimedia library which could result in denial of service and potentially the execution of arbitrary code if malformed WebM files are processed.

Update to 1.8.2. Fixes several security vulnerabilities:
CVE-2019-9232, CVE 2019-9433, CVE-2019-9325, CVE-2019-9371, CVE-2019-2126

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4629 advisory.

  - In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a     freed pointer. This could lead to remote code execution with no additional execution privileges needed.
    User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1     Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368. (CVE-2019-2126)

  - In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote     information disclosure with no additional execution privileges needed. User interaction is not needed for     exploitation. Product: AndroidVersions: Android-10Android ID: A-122675483 (CVE-2019-9232)

  - In libvpx, there is a possible resource exhaustion due to improper input validation. This could lead to     remote denial of service with no additional execution privileges needed. User interaction is needed for     exploitation. Product: AndroidVersions: Android-10Android ID: A-132783254 (CVE-2019-9371)

  - In libvpx, there is a possible information disclosure due to improper input validation. This could lead to     remote information disclosure with no additional execution privileges needed. User interaction is needed     for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354 (CVE-2019-9433)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4629 advisory.

    The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec,     commonly used with the WebM multimedia container file format.

    Security Fix(es):

    * libvpx: Double free in ParseContentEncodingEntry() in mkvparser.cc (CVE-2019-2126)

    * libvpx: Out of bounds read in vp8_norm table (CVE-2019-9232)

    * libvpx: Resource exhaustion after memory leak in mkvparser.cc (CVE-2019-9371)

    * libvpx: Use-after-free in vp8_deblock() in vp8/common/postproc.c (CVE-2019-9433)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has libvpx packages installed that are affected by multiple vulnerabilities:

  - In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote     information disclosure with no additional execution privileges needed. User interaction is not needed for     exploitation. Product: AndroidVersions: Android-10Android ID: A-122675483 (CVE-2019-9232)

  - In libvpx, there is a possible information disclosure due to improper input validation. This could lead to     remote information disclosure with no additional execution privileges needed. User interaction is needed     for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354 (CVE-2019-9433)

  - In libvpx, there is a possible resource exhaustion due to improper input validation. This could lead to     remote denial of service with no additional execution privileges needed. User interaction is needed for     exploitation. Product: AndroidVersions: Android-10Android ID: A-132783254 (CVE-2019-9371)

  - In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a     freed pointer. This could lead to remote code execution with no additional execution privileges needed.
    User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1     Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368. (CVE-2019-2126)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4629 advisory.

  - libvpx: Double free in ParseContentEncodingEntry() in mkvparser.cc (CVE-2019-2126)

  - libvpx: Out of bounds read in vp8_norm table (CVE-2019-9232)

  - libvpx: Resource exhaustion after memory leak in mkvparser.cc (CVE-2019-9371)

  - libvpx: Use-after-free in vp8_deblock() in vp8/common/postproc.c (CVE-2019-9433)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4629 advisory.

  - In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a     freed pointer. This could lead to remote code execution with no additional execution privileges needed.
    User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1     Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368. (CVE-2019-2126)

  - In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote     information disclosure with no additional execution privileges needed. User interaction is not needed for     exploitation. Product: AndroidVersions: Android-10Android ID: A-122675483 (CVE-2019-9232)

  - In libvpx, there is a possible resource exhaustion due to improper input validation. This could lead to     remote denial of service with no additional execution privileges needed. User interaction is needed for     exploitation. Product: AndroidVersions: Android-10Android ID: A-132783254 (CVE-2019-9371)

  - In libvpx, there is a possible information disclosure due to improper input validation. This could lead to     remote information disclosure with no additional execution privileges needed. User interaction is needed     for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354 (CVE-2019-9433)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0097 advisory.

    This advisory aggregates security fixes for the libvpx SRPM in CIQ LTS 8.6. It addresses 9 CVEs:
    CVE-2023-5217, CVE-2019-2126, CVE-2017-13194, CVE-2015-1258, CVE-2019-9232, and 4 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
131439	Debian DSA-4578-1 : libvpx - security update	Nessus	Debian Local Security Checks	2019/12/3	2019/12/9	high
133236	Fedora 30 : libvpx (2020-6cd410d9e4)	Nessus	Fedora Local Security Checks	2020/1/27	2024/3/28	high
157620	AlmaLinux 8 : libvpx (ALSA-2020:4629)	Nessus	Alma Linux Local Security Checks	2022/2/9	2022/2/14	high
142413	RHEL 8 : libvpx (RHSA-2020:4629)	Nessus	Red Hat Local Security Checks	2020/11/4	2024/11/7	high
147382	NewStart CGSL MAIN 6.02 : libvpx Multiple Vulnerabilities (NS-SA-2021-0060)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2021/3/11	high
146031	CentOS 8 : libvpx (CESA-2020:4629)	Nessus	CentOS Local Security Checks	2021/2/1	2021/3/23	high
184953	Rocky Linux 8 : libvpx (RLSA-2020:4629)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2023/11/7	high
358249	Rocky Linux 8.6 [CIQ] Security Update: libvpx / libvpx-debuginfo / libvpx-debugsource / libvpx-devel Multiple Vulnerabilities (ciqsa-2026_0097)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/11	critical

检测

插件搜索

high

high

high

high

high

high

high

critical