The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9827 advisory.

    The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec,     commonly used with the WebM multimedia container file format.

    Security Fix(es):

    * libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5722 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5722-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 26, 2024                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libvpx     CVE ID         : CVE-2024-5197

    It was discovered that multiple integer overflows in libvpx, a     multimedia library for the VP8 and VP9 video codecs, may result in     denial of service and potentially the execution of arbitrary code.

    For the oldstable distribution (bullseye), this problem has been fixed     in version 1.9.0-1+deb11u3.

    For the stable distribution (bookworm), this problem has been fixed in     version 1.12.0-1+deb12u3.

    We recommend that you upgrade your libvpx packages.

    For the detailed security status of libvpx please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libvpx

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0525 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-5197:
    There exists interger overflows in libvpx in versions prior to 1.14.1.Calling vpx_img_alloc()with a     large value of the d_w, d_h, or alignparameter may result in integer overflows in the calculations of     buffer sizes and offsets and some fields of the returned vpx_image_tstruct may be invalid.Calling     vpx_img_wrap()with a large value of the d_w, d_h, or stride_alignparameter may result in integer     overflows in the calculations of buffer sizes and offsets and some fields of the returned     vpx_image_tstruct may be invalid. We recommend upgrading to version 1.14.1 or beyond

    CVE-2024-5171:
    Integer overflow in libaom internal functionimg_alloc_helper can lead to heap buffer overflow. This     function can be reached via 3 callers:


    *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer     overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t     struct may be invalid.
    *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer     overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t     struct may be invalid.
    *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border     parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields     of the returned aom_image_t struct may be invalid.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has libvpx packages installed that are affected by a vulnerability:

  - There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a     large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of     buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling     vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer     overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t     struct may be invalid. We recommend upgrading to version 1.14.1 or beyond (CVE-2024-5197)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1207 advisory.

    A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the     originally configured size with VP9 may result in a heap overflow in libvpx.We recommend upgrading to     version 1.13.1 or above (CVE-2023-6349)

    There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a     large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of     buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling     vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer     overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t     struct may be invalid. We recommend upgrading to version 1.14.1 or beyond (CVE-2024-5197)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777973407 advisory.

  - There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a     large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of     buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling     vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer     overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t     struct may be invalid. We recommend upgrading to version 1.14.1 or beyond (CVE-2024-5197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2024_5941 advisory.

    * libvpx: Heap buffer overflow related to VP9 encoding (CVE-2023-6349)

    * libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:5941 advisory.

    * libvpx: Heap buffer overflow related to VP9 encoding (CVE-2023-6349)
    * libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:5941 advisory.

    * libvpx: Heap buffer overflow related to VP9 encoding (CVE-2023-6349)

    * libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8736:01 advisory.

    * libvpx: Heap buffer overflow related to VP9 encoding (CVE-2023-6349)
      * libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-9404:02 advisory.

    * libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2024_9827 advisory.

    * libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
211767	RHEL 9 : libvpx (RHSA-2024:9827)	Nessus	Red Hat Local Security Checks	2024/11/24	2025/7/23	medium
201050	Debian dsa-5722 : libvpx-dev - security update	Nessus	Debian Local Security Checks	2024/6/26	2025/7/23	medium
239713	TencentOS Server 4: libvpx (TSSA-2024:0525)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	medium
238007	NewStart CGSL MAIN 7.02 : libvpx Vulnerability (NS-SA-2025-0071)	Nessus	NewStart CGSL Local Security Checks	2025/6/9	2025/6/18	medium
266147	Amazon Linux 2023 : libvpx, libvpx-devel, libvpx-utils (ALAS2023-2025-1207)	Nessus	Amazon Linux Local Security Checks	2025/9/30	2025/10/30	medium
360442	Rocky Linux 9.6 [TuxCare] Security Update: libvpx / libvpx-devel / libvpx-utils (ALMALINUX9.6:CLSA-2026:1777973407)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
353504	Rocky Linux 8 [CIQ] Security Update: libvpx / libvpx-debuginfo / libvpx-debugsource / libvpx-devel Multiple Vulnerabilities (crlsa-2024_5941)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
206323	AlmaLinux 8 : libvpx (ALSA-2024:5941)	Nessus	Alma Linux Local Security Checks	2024/8/29	2025/7/23	medium
207310	Rocky Linux 8 : libvpx (RLSA-2024:5941)	Nessus	Rocky Linux Local Security Checks	2024/9/16	2025/7/23	medium
293380	MiracleLinux 8 : libvpx-1.7.0-11.el8_10 (AXSA:2024-8736:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
293611	MiracleLinux 9 : libvpx-1.9.0-8.el9_5 (AXSA:2024-9404:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
358227	Rocky Linux 9 [CIQ] Security Update: libvpx / libvpx-debuginfo / libvpx-debugsource / libvpx-devel (crlsa-2024_9827)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium