CVE-2019-2126

In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368.

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.

Security Fix(es):

• libvpx: Double free in ParseContentEncodingEntry() in mkvparser.cc (CVE-2019-2126)

• libvpx: Out of bounds read in vp8_norm table (CVE-2019-9232)

• libvpx: Resource exhaustion after memory leak in mkvparser.cc (CVE-2019-9371)

• libvpx: Use-after-free in vp8_deblock() in vp8/common/postproc.c (CVE-2019-9433)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Updated libvpx packages fix security vulnerabilities:

It was discovered that libvpx did not properly handle certain malformed WebM media files. If an application using libvpx opened a specially crafted WebM file, a remote attacker could cause a denial of service, or possibly execute arbitrary code (CVE-2019-2126, CVE-2019-9371).

This update for libvpx fixes the following issues:

• CVE-2019-2126: Fixed a double free in ParseContentEncodingEntry() (bsc#1160611).
• CVE-2019-9325: Fixed an out-of-bounds read (bsc#1160612).
• CVE-2019-9232: Fixed an out-of-bounds memory access on fuzzed data (bsc#1160613).
• CVE-2019-9433: Fixed a use-after-free in vp8_deblock() (bsc#1160614).
• CVE-2019-9371: Fixed a resource exhaustion after memory leak (bsc#1160615).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libvpx-devel-1.10.0-1.3 package on the GA media of openSUSE Tumbleweed.

This update for libvpx fixes the following issues:

• CVE-2019-2126: Fixed a double free in ParseContentEncodingEntry() (bsc#1160611).
• CVE-2019-9325: Fixed an out-of-bounds read (bsc#1160612).
• CVE-2019-9232: Fixed an out-of-bounds memory access on fuzzed data (bsc#1160613).
• CVE-2019-9433: Fixed a use-after-free in vp8_deblock() (bsc#1160614).
• CVE-2019-9371: Fixed a resource exhaustion after memory leak (bsc#1160615).

It was discovered that libvpx did not properly handle certain malformed WebM media files. If an application using libvpx opened a specially crafted WebM file, a remote attacker could cause a denial of service, or possibly execute arbitrary code.

It was discovered that the Godot Engine did not properly handle certain malformed WebM media files. If the Godot Engine opened a specially crafted WebM file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. (CVE-2019-2126)

It was discovered that the Godot Engine did not properly handle certain malformed TGA image files. If the Godot Engine opened a specially crafted TGA image file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2021-26825, CVE-2021-26826)