Multiple security issues were found in libvpx multimedia library which could result in denial of service and potentially the execution of arbitrary code if malformed WebM files are processed.

Update to 1.8.2. Fixes several security vulnerabilities:
CVE-2019-9232, CVE 2019-9433, CVE-2019-9325, CVE-2019-9371, CVE-2019-2126

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4629 advisory.

  - In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a     freed pointer. This could lead to remote code execution with no additional execution privileges needed.
    User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1     Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368. (CVE-2019-2126)

  - In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote     information disclosure with no additional execution privileges needed. User interaction is not needed for     exploitation. Product: AndroidVersions: Android-10Android ID: A-122675483 (CVE-2019-9232)

  - In libvpx, there is a possible resource exhaustion due to improper input validation. This could lead to     remote denial of service with no additional execution privileges needed. User interaction is needed for     exploitation. Product: AndroidVersions: Android-10Android ID: A-132783254 (CVE-2019-9371)

  - In libvpx, there is a possible information disclosure due to improper input validation. This could lead to     remote information disclosure with no additional execution privileges needed. User interaction is needed     for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354 (CVE-2019-9433)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0048 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-2126:
    In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a     freed pointer. This could lead to remote code execution with no additional execution privileges needed.
    User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1     Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368.

    CVE-2019-9232:
    In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote     information disclosure with no additional execution privileges needed. User interaction is not needed for     exploitation. Product: AndroidVersions: Android-10Android ID: A-122675483

    CVE-2019-9371:
    In libvpx, there is a possible resource exhaustion due to improper input validation. This could lead to     remote denial of service with no additional execution privileges needed. User interaction is needed for     exploitation. Product: AndroidVersions: Android-10Android ID: A-132783254

    CVE-2019-9433:
    In libvpx, there is a possible information disclosure due to improper input validation. This could lead to     remote information disclosure with no additional execution privileges needed. User interaction is needed     for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0048 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-2126:
    In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a     freed pointer. This could lead to remote code execution with no additional execution privileges needed.
    User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1     Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368.

    CVE-2019-9232:
    In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote     information disclosure with no additional execution privileges needed. User interaction is not needed for     exploitation. Product: AndroidVersions: Android-10Android ID: A-122675483

    CVE-2019-9371:
    In libvpx, there is a possible resource exhaustion due to improper input validation. This could lead to     remote denial of service with no additional execution privileges needed. User interaction is needed for     exploitation. Product: AndroidVersions: Android-10Android ID: A-132783254

    CVE-2019-9433:
    In libvpx, there is a possible information disclosure due to improper input validation. This could lead to     remote information disclosure with no additional execution privileges needed. User interaction is needed     for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2020_4629 advisory.

    * libvpx: Double free in ParseContentEncodingEntry() in mkvparser.cc (CVE-2019-2126)

    * libvpx: Out of bounds read in vp8_norm table (CVE-2019-9232)

    * libvpx: Resource exhaustion after memory leak in mkvparser.cc (CVE-2019-9371)

    * libvpx: Use-after-free in vp8_deblock() in vp8/common/postproc.c (CVE-2019-9433)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-59 (libvpx: User-assisted execution of arbitrary code)

    Multiple vulnerabilities have been discovered in libvpx. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file, possibly resulting in the execution of arbitrary code with the       privileges of the user running the application, or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

This update for libvpx fixes the following issues :

CVE-2019-2126: Fixed a double free in ParseContentEncodingEntry() (bsc#1160611).

CVE-2019-9325: Fixed an out-of-bounds read (bsc#1160612).

CVE-2019-9232: Fixed an out-of-bounds memory access on fuzzed data (bsc#1160613).

CVE-2019-9433: Fixed a use-after-free in vp8_deblock() (bsc#1160614).

CVE-2019-9371: Fixed a resource exhaustion after memory leak (bsc#1160615).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
131439	Debian DSA-4578-1 : libvpx - security update	Nessus	Debian Local Security Checks	2019/12/3	2019/12/9	high
133236	Fedora 30 : libvpx (2020-6cd410d9e4)	Nessus	Fedora Local Security Checks	2020/1/27	2024/3/28	high
157620	AlmaLinux 8 : libvpx (ALSA-2020:4629)	Nessus	Alma Linux Local Security Checks	2022/2/9	2022/2/14	high
236547	Alibaba Cloud Linux 3 : 0048: libvpx (ALINUX3-SA-2022:0048)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
239911	TencentOS Server 3: libvpx (TSSA-2022:0048)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
358877	Rocky Linux 8 [CIQ] Security Update: libvpx / libvpx-debuginfo / libvpx-debugsource / libvpx-devel Multiple Vulnerabilities (crlsa-2020_4629)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
134967	GLSA-202003-59 : libvpx: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	2020/3/27	2020/3/31	high
133141	SUSE SLED15 / SLES15 Security Update : libvpx (SUSE-SU-2020:0143-1)	Nessus	SuSE Local Security Checks	2020/1/21	2024/3/29	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high