{"id":"CVE-2019-2126","aliases":["ALSA-2020:4629","EUVD-2019-11768","GHSA-jxxw-46w4-3vhv","MGASA-2019-0369","RHSA-2020:4629","RLSA-2020:4629","SUSE-SU-2020:0143-1","UBUNTU-CVE-2019-2126","USN-4199-1","USN-7579-1","openSUSE-SU-2020:0105-1","openSUSE-SU-2024:11010-1"],"status":"published","title":"In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing...","description":"In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05508,"percentile":0.92853,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2019-08-20T19:49:04Z","modified":"2026-10-29T11:00:14Z","fixes":[{"ecosystem":"Ubuntu:18.04:LTS","package":"libvpx","fixed_in":["1.7.0-3ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"godot","fixed_in":["3.2-stable-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"godot","fixed_in":["3.2.3-stable-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"godot","fixed_in":["3.5.2-stable-2ubuntu0.24.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libvpx-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:7","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvpx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvpx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvpx-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvpx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvpx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvpx-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvpx-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-3ubuntu0.18.04.1"}]}],"versions":["1.6.1-3","1.7.0-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.1+dfsg-4","5.9.1+dfsg-4ubuntu1","5.9.2+dfsg-2ubuntu1","5.9.3+dfsg-0ubuntu1","5.9.4+dfsg-0ubuntu1","5.9.5+dfsg-0ubuntu2","5.9.5+dfsg-0ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0-3","1.0.0.errata1-2","1.0.0.errata1-2ubuntu3","1.0.0.errata1-3","1.0.0.errata1-3build1","1.0.0.errata1-3+deb11u1build0.20.04.1","1.0.0.errata1-3+deb11u1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2-stable-2ubuntu0.1~esm1"}]}],"versions":["3.0.6-2build1","3.0.6-2build2","3.2-stable-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12.4+dfsg-1ubuntu1","5.12.4+dfsg-1ubuntu3","5.12.5+dfsg-3ubuntu1","5.12.5+dfsg-6ubuntu2","5.12.5+dfsg-7","5.12.5+dfsg-7build1","5.12.8+dfsg-0ubuntu1","5.12.8+dfsg-0ubuntu1.1","5.12.8+dfsg-0ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0.errata1-3build1","3.2.0-2","3.3.0-1","3.3.0-1ubuntu0.1","3.3.0-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-stable-1ubuntu0.1~esm1"}]}],"versions":["3.2.3-stable-1","3.2.3-stable-1build1","3.2.3-stable-1build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.6+dfsg-1","5.15.6+dfsg-2","5.15.7+dfsg-2","5.15.8+dfsg-1","5.15.8+dfsg-1build1","5.15.8+dfsg-1build2","5.15.8+dfsg-2","5.15.9+dfsg-1","5.15.9+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-stable-2ubuntu0.24.04.1~esm1"}]}],"versions":["3.5.2-stable-2","3.5.2-stable-2build1","3.5.2-stable-2build3","3.5.2-stable-2build4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-2","5.15.15+dfsg-2build2","5.15.15+dfsg-2ubuntu1","5.15.16+dfsg-1","5.15.16+dfsg-1ubuntu2","5.15.16+dfsg-1ubuntu4","5.15.16+dfsg-3","5.15.16+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6+ds-2","3.6+ds-2ubuntu1","4.4.1+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.18+dfsg-2","5.15.18+dfsg-2build1","5.15.19+dfsg-1","5.15.19+dfsg2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.6.3+ds-1","4.6.3+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.19+dfsg2-4","5.15.19+dfsg2-6","5.15.19+dfsg2-7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.19+dfsg2-1","5.15.19+dfsg2-1build1","5.15.19+dfsg2-2","5.15.19+dfsg2-3","5.15.19+dfsg2-4","5.15.19+dfsg2-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-2ubuntu1.1"}]}],"versions":["1.4.0-4","1.5.0-2","1.5.0-2ubuntu1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-3ubuntu0.18.04.1"}]}],"versions":["1.6.1-3","1.7.0-3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2-stable-2ubuntu0.1~esm1"}]}],"versions":["3.0.6-2build1","3.0.6-2build2","3.2-stable-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-stable-1ubuntu0.1~esm1"}]}],"versions":["3.2.3-stable-1","3.2.3-stable-1build1","3.2.3-stable-1build2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"godot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-stable-2ubuntu0.24.04.1~esm1"}]}],"versions":["3.5.2-stable-2","3.5.2-stable-2build1","3.5.2-stable-2build3","3.5.2-stable-2build4"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-lp151.5.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-1.3"}]}],"bundled":7}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"google","product":"android"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://source.android.com/security/bulletin/2019-08-01","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"https://usn.ubuntu.com/4199-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2IIA3RSYABBUCFIHXIRVUT5CTJVWWZ6/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQSTK442ATWJOR4TU3MR6C3N5A6NDFFN/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00049.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2126","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DQSTK442ATWJOR4TU3MR6C3N5A6NDFFN/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U2IIA3RSYABBUCFIHXIRVUT5CTJVWWZ6/"},{"url":"https://github.com/advisories/GHSA-jxxw-46w4-3vhv"},{"url":"https://errata.almalinux.org/8/ALSA-2020-4629.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-2126","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9232","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9371","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9433","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2019-0369.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25789","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4629","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788966","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788994","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789008","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4629.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2126","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2126","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9232","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9232","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9371","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9371","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9371","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9433","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9433","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9433","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:4629","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200143-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1160611","tags":["report"]},{"url":"https://bugzilla.suse.com/1160612","tags":["report"]},{"url":"https://bugzilla.suse.com/1160613","tags":["report"]},{"url":"https://bugzilla.suse.com/1160614","tags":["report"]},{"url":"https://bugzilla.suse.com/1160615","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9433","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-2126","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4199-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7579-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-13194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9433","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-26825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-26826","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/T4RF53ZFC352SC6CQMBMJW5OCHIHHCUV/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13194","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-2126","description":"In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368.","status":"published","published":"2019-08-20T19:49:04Z","modified":"2024-08-04T18:42:50.421Z","updated_at":"2026-11-02T14:20:22.701371Z"}],"euvd":[{"id":"EUVD-2019-11768","description":"In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368.","status":"published","published":"2019-08-20T19:49:04Z","modified":"2024-08-04T18:42:50Z","updated_at":"2026-11-03T03:06:56.517205Z"}],"ghsa":[{"id":"GHSA-jxxw-46w4-3vhv","title":"In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing...","description":"In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368.","status":"published","published":"2022-05-24T16:54:05Z","modified":"2023-03-29T18:30:29Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:54:24.674255Z"}],"nvd":[{"id":"CVE-2019-2126","description":"In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368.","status":"published","published":"2019-08-20T20:15:12.323Z","modified":"2026-06-17T02:33:17.917Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:05:23.725587Z"}],"osv":[{"id":"RHSA-2020:4629","title":"Red Hat Security Advisory: libvpx security update","status":"published","published":"2024-09-16T03:51:10Z","modified":"2026-06-27T10:12:06Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RLSA-2020:4629","title":"Moderate: libvpx security update","description":"The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.\n\nSecurity Fix(es):\n\n* libvpx: Double free in ParseContentEncodingEntry() in mkvparser.cc (CVE-2019-2126)\n\n* libvpx: Out of bounds read in vp8_norm table (CVE-2019-9232)\n\n* libvpx: Resource exhaustion after memory leak in mkvparser.cc (CVE-2019-9371)\n\n* libvpx: Use-after-free in vp8_deblock() in vp8/common/postproc.c (CVE-2019-9433)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:21:50Z","modified":"2026-02-05T10:15:04.218709Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-2126","description":"In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368.","status":"published","published":"2019-08-20T20:15:00Z","modified":"2026-10-17T12:56:07.666556572Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"ALSA-2020:4629","title":"Moderate: libvpx security update","description":"The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.\n\nSecurity Fix(es):\n\n* libvpx: Double free in ParseContentEncodingEntry() in mkvparser.cc (CVE-2019-2126)\n\n* libvpx: Out of bounds read in vp8_norm table (CVE-2019-9232)\n\n* libvpx: Resource exhaustion after memory leak in mkvparser.cc (CVE-2019-9371)\n\n* libvpx: Use-after-free in vp8_deblock() in vp8/common/postproc.c (CVE-2019-9433)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:21:50Z","modified":"2026-10-29T11:00:14.494755183Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"MGASA-2019-0369","title":"Updated libvpx packages fix security vulnerabilities","description":"Updated libvpx packages fix security vulnerabilities:\n\nIt was discovered that libvpx did not properly handle certain malformed\nWebM media files. If an application using libvpx opened a specially crafted\nWebM file, a remote attacker could cause a denial of service, or possibly\nexecute arbitrary code (CVE-2019-2126, CVE-2019-9371).\n","status":"published","published":"2019-12-06T14:15:42Z","modified":"2026-04-16T04:41:25.103870924Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0105-1","title":"Security update for libvpx","description":"This update for libvpx fixes the following issues:\n\n- CVE-2019-2126: Fixed a double free in ParseContentEncodingEntry() (bsc#1160611).\n- CVE-2019-9325: Fixed an out-of-bounds read (bsc#1160612).\n- CVE-2019-9232: Fixed an out-of-bounds memory access on fuzzed data (bsc#1160613).\n- CVE-2019-9433: Fixed a use-after-free in vp8_deblock() (bsc#1160614).\n- CVE-2019-9371: Fixed a resource exhaustion after memory leak (bsc#1160615).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-01-25T23:14:06Z","modified":"2026-02-04T03:52:31.089558Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11010-1","title":"libvpx-devel-1.10.0-1.3 on GA media","description":"These are all security issues fixed in the libvpx-devel-1.10.0-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:38:09.530163Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2020:0143-1","title":"Security update for libvpx","description":"This update for libvpx fixes the following issues:\n\n- CVE-2019-2126: Fixed a double free in ParseContentEncodingEntry() (bsc#1160611).\n- CVE-2019-9325: Fixed an out-of-bounds read (bsc#1160612).\n- CVE-2019-9232: Fixed an out-of-bounds memory access on fuzzed data (bsc#1160613).\n- CVE-2019-9433: Fixed a use-after-free in vp8_deblock() (bsc#1160614).\n- CVE-2019-9371: Fixed a resource exhaustion after memory leak (bsc#1160615).\n","status":"published","published":"2020-01-20T15:11:14Z","modified":"2026-02-04T03:45:42.817885Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4199-1","title":"libvpx vulnerabilities","description":"It was discovered that libvpx did not properly handle certain malformed\nWebM media files. If an application using libvpx opened a specially crafted\nWebM file, a remote attacker could cause a denial of service, or possibly\nexecute arbitrary code.\n","status":"published","published":"2019-11-25T13:25:11Z","modified":"2026-04-27T15:48:46.440554671Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-7579-1","title":"godot vulnerabilities","description":"It was discovered that the Godot Engine did not properly handle\ncertain malformed WebM media files. If the Godot Engine opened a\nspecially crafted WebM file, a remote attacker could cause a denial\nof service, or possibly execute arbitrary code. (CVE-2019-2126)\n\nIt was discovered that the Godot Engine did not properly handle\ncertain malformed TGA image files. If the Godot Engine opened a\nspecially crafted TGA image file, a remote attacker could cause\na denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.\n(CVE-2021-26825, CVE-2021-26826)","status":"published","published":"2025-06-18T15:50:49Z","modified":"2026-04-27T18:03:59.894432Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}