{"id":"CVE-2019-9433","aliases":["ALPINE-CVE-2019-9433","ALSA-2020:4629","DEBIAN-CVE-2019-9433","DLA-2012-1","DSA-4578-1","EUVD-2019-18807","GHSA-45wr-h3w5-q72v","RHSA-2020:3876","RHSA-2020:4629","RLSA-2020:4629","SUSE-SU-2020:0143-1","SUSE-SU-2020:0459-1","UBUNTU-CVE-2019-9433","USN-4199-1","USN-4199-2","openSUSE-SU-2020:0105-1","openSUSE-SU-2024:11010-1"],"status":"published","title":"In libvpx, there is a possible information disclosure due to improper input validation. This...","description":"In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02998,"percentile":0.87443,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2019-09-27T18:05:18Z","modified":"2026-11-03T06:32:23Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"libvpx","fixed_in":["1.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"libvpx","fixed_in":["1.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"libvpx","fixed_in":["1.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libvpx","fixed_in":["1.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libvpx","fixed_in":["1.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libvpx","fixed_in":["1.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libvpx","fixed_in":["1.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libvpx","fixed_in":["1.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libvpx","fixed_in":["1.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libvpx","fixed_in":["1.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libvpx","fixed_in":["1.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libvpx","fixed_in":["1.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libvpx","fixed_in":["1.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libvpx","fixed_in":["1.8.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libvpx","fixed_in":["1.8.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libvpx","fixed_in":["1.8.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libvpx","fixed_in":["1.8.1-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libvpx","fixed_in":["1.3.0-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libvpx","fixed_in":["1.5.0-2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libvpx","fixed_in":["1.7.0-3ubuntu0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libvpx-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-3+deb8u2"}]}],"versions":["1.3.0-3","1.3.0-3+deb8u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-3+deb9u2"}]}],"versions":["1.6.1-3","1.6.1-3+deb9u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:10","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-3+deb10u1"}]}],"versions":["1.7.0-3"],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-8.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvpx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-8.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvpx-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-8.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvpx-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-8.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-8.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvpx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-8.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvpx-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-8.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libvpx-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-8.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-8.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvpx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-8.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvpx-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-8.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvpx-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-8.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-8.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvpx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-8.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvpx-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-8.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvpx-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-8.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvpx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvpx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvpx-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvpx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvpx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvpx-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvpx-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-8.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2ubuntu0.1~esm1"}]}],"versions":["1.2.0-2","1.3.0-1","1.3.0-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-2ubuntu1.1"}]}],"versions":["1.4.0-4","1.5.0-2","1.5.0-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-3ubuntu0.18.04.1"}]}],"versions":["1.6.1-3","1.7.0-3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-2ubuntu1.1"}]}],"versions":["1.4.0-4","1.5.0-2","1.5.0-2ubuntu1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-3ubuntu0.18.04.1"}]}],"versions":["1.6.1-3","1.7.0-3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2ubuntu0.1~esm1"}]}],"versions":["1.2.0-2","1.3.0-1","1.3.0-2"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-lp151.5.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-1.3"}]}],"bundled":7}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"google","product":"android"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://source.android.com/security/bulletin/android-10","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2019/10/25/17","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article"]},{"url":"http://www.openwall.com/lists/oss-security/2019/10/27/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article"]},{"url":"http://www.openwall.com/lists/oss-security/2019/11/07/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article"]},{"url":"https://usn.ubuntu.com/4199-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/11/msg00030.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://seclists.org/bugtraq/2019/Nov/43","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4578","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2IIA3RSYABBUCFIHXIRVUT5CTJVWWZ6/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQSTK442ATWJOR4TU3MR6C3N5A6NDFFN/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00049.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202003-59","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4199-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9433","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DQSTK442ATWJOR4TU3MR6C3N5A6NDFFN/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U2IIA3RSYABBUCFIHXIRVUT5CTJVWWZ6/"},{"url":"https://github.com/advisories/GHSA-45wr-h3w5-q72v"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-9433","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2020-4629.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-2126","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9232","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9371","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9433","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-9433","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3876","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1769657","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788966","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788994","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1813000","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3876.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-0393","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-0393","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0393","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9232","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9232","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9433","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9433","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-0034","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-0034","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-0034","tags":["advisory"]},{"url":"https://source.android.com/security/bulletin/2020-03-01","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4629","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789008","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4629.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2126","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2126","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2126","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9371","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9371","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9371","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:4629","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200143-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1160611","tags":["report"]},{"url":"https://bugzilla.suse.com/1160612","tags":["report"]},{"url":"https://bugzilla.suse.com/1160613","tags":["report"]},{"url":"https://bugzilla.suse.com/1160614","tags":["report"]},{"url":"https://bugzilla.suse.com/1160615","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9433","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200459-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-9433","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2019/11/07/1","tags":["report"]},{"url":"https://chromium-review.googlesource.com/c/webm/libvpx/+/1070753","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4199-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4199-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-13194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9371","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/T4RF53ZFC352SC6CQMBMJW5OCHIHHCUV/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13194","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-9433","description":"In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354","status":"published","published":"2019-09-27T18:05:18Z","modified":"2024-08-04T21:46:30.345Z","updated_at":"2026-11-02T14:20:20.397093Z"}],"euvd":[{"id":"EUVD-2019-18807","description":"In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354","status":"published","published":"2019-09-27T18:05:18Z","modified":"2024-08-04T21:46:30Z","updated_at":"2026-11-03T03:06:38.777229Z"}],"ghsa":[{"id":"GHSA-45wr-h3w5-q72v","title":"In libvpx, there is a possible information disclosure due to improper input validation. This...","description":"In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354","status":"published","published":"2022-05-24T22:00:55Z","modified":"2023-01-28T05:04:54Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:44:15.993879Z"}],"nvd":[{"id":"CVE-2019-9433","description":"In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354","status":"published","published":"2019-09-27T19:15:29Z","modified":"2026-06-17T02:43:43.743Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:05:30.039477Z"}],"osv":[{"id":"ALPINE-CVE-2019-9433","description":"In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354","status":"published","published":"2019-09-27T19:15:29Z","modified":"2026-11-03T06:32:23.120655602Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2019-9433","description":"In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354","status":"published","published":"2019-09-27T19:15:29Z","modified":"2026-03-15T22:29:53.813457Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:12.974481Z"},{"id":"DEBIAN-CVE-2019-9433","description":"In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354","status":"published","published":"2019-09-27T19:15:29Z","modified":"2026-09-21T07:03:25.737995103Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"RHSA-2020:3876","title":"Red Hat Security Advisory: libvpx security update","status":"published","published":"2024-09-16T03:36:58Z","modified":"2026-06-27T10:11:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:4629","title":"Red Hat Security Advisory: libvpx security update","status":"published","published":"2024-09-16T03:51:10Z","modified":"2026-06-27T10:12:06Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RLSA-2020:4629","title":"Moderate: libvpx security update","description":"The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.\n\nSecurity Fix(es):\n\n* libvpx: Double free in ParseContentEncodingEntry() in mkvparser.cc (CVE-2019-2126)\n\n* libvpx: Out of bounds read in vp8_norm table (CVE-2019-9232)\n\n* libvpx: Resource exhaustion after memory leak in mkvparser.cc (CVE-2019-9371)\n\n* libvpx: Use-after-free in vp8_deblock() in vp8/common/postproc.c (CVE-2019-9433)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:21:50Z","modified":"2026-02-05T10:15:04.218709Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-9433","description":"In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354","status":"published","published":"2019-09-27T19:15:00Z","modified":"2026-04-22T12:23:05.032253Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"ALSA-2020:4629","title":"Moderate: libvpx security update","description":"The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.\n\nSecurity Fix(es):\n\n* libvpx: Double free in ParseContentEncodingEntry() in mkvparser.cc (CVE-2019-2126)\n\n* libvpx: Out of bounds read in vp8_norm table (CVE-2019-9232)\n\n* libvpx: Resource exhaustion after memory leak in mkvparser.cc (CVE-2019-9371)\n\n* libvpx: Use-after-free in vp8_deblock() in vp8/common/postproc.c (CVE-2019-9433)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:21:50Z","modified":"2026-10-29T11:00:14.494755183Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-2012-1","title":"libvpx - security update","status":"published","published":"2019-11-26T00:00:00Z","modified":"2026-03-09T01:21:00.879662Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4578-1","title":"libvpx - security update","status":"published","published":"2019-11-28T00:00:00Z","modified":"2026-03-09T02:11:41.404498Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2020:0105-1","title":"Security update for libvpx","description":"This update for libvpx fixes the following issues:\n\n- CVE-2019-2126: Fixed a double free in ParseContentEncodingEntry() (bsc#1160611).\n- CVE-2019-9325: Fixed an out-of-bounds read (bsc#1160612).\n- CVE-2019-9232: Fixed an out-of-bounds memory access on fuzzed data (bsc#1160613).\n- CVE-2019-9433: Fixed a use-after-free in vp8_deblock() (bsc#1160614).\n- CVE-2019-9371: Fixed a resource exhaustion after memory leak (bsc#1160615).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-01-25T23:14:06Z","modified":"2026-02-04T03:52:31.089558Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11010-1","title":"libvpx-devel-1.10.0-1.3 on GA media","description":"These are all security issues fixed in the libvpx-devel-1.10.0-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:38:09.530163Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2020:0143-1","title":"Security update for libvpx","description":"This update for libvpx fixes the following issues:\n\n- CVE-2019-2126: Fixed a double free in ParseContentEncodingEntry() (bsc#1160611).\n- CVE-2019-9325: Fixed an out-of-bounds read (bsc#1160612).\n- CVE-2019-9232: Fixed an out-of-bounds memory access on fuzzed data (bsc#1160613).\n- CVE-2019-9433: Fixed a use-after-free in vp8_deblock() (bsc#1160614).\n- CVE-2019-9371: Fixed a resource exhaustion after memory leak (bsc#1160615).\n","status":"published","published":"2020-01-20T15:11:14Z","modified":"2026-02-04T03:45:42.817885Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0459-1","title":"Security update for libvpx","description":"This update for libvpx fixes the following issues:\n\n- CVE-2019-9232: Fixed an out of bound memory access (bsc#1160613).\n- CVE-2019-9433: Fixdd a use-after-free in vp8_deblock() (bsc#1160614).\n","status":"published","published":"2020-02-25T10:02:29Z","modified":"2026-02-04T03:39:42.084436Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4199-1","title":"libvpx vulnerabilities","description":"It was discovered that libvpx did not properly handle certain malformed\nWebM media files. If an application using libvpx opened a specially crafted\nWebM file, a remote attacker could cause a denial of service, or possibly\nexecute arbitrary code.\n","status":"published","published":"2019-11-25T13:25:11Z","modified":"2026-04-27T15:48:46.440554671Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4199-2","title":"libvpx vulnerabilities","description":"USN-4199-1 fixed several vulnerabilities in libvpx. This update provides\nthe corresponding update for Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that libvpx did not properly handle certain malformed\n WebM media files. If an application using libvpx opened a specially crafted\n WebM file, a remote attacker could cause a denial of service, or possibly\n execute arbitrary code.\n","status":"published","published":"2020-07-15T14:54:46Z","modified":"2026-04-22T09:50:07.372735Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}