{"id":"CVE-2024-5197","aliases":["ALPINE-CVE-2024-5197","ALSA-2024:5941","ALSA-2024:9827","AZL-42958","AZL-42963","CLSA-2025-1755003990","CLSA-2026-1777973407","DEBIAN-CVE-2024-5197","DLA-3830-1","DSA-5722-1","EUVD-2024-46440","GHSA-4h58-f788-v8pw","JLSEC-2026-377","MGASA-2024-0221","OESA-2024-1716","RHSA-2024:5941","RHSA-2024:9827","RHSA-2025:14138","RHSA-2025:14139","RHSA-2025:14140","RLSA-2024:5941","RLSA-2024:9827","SUSE-SU-2024:2408-1","SUSE-SU-2024:2409-1","UBUNTU-CVE-2024-5197","USN-6814-1","USN-7249-1","openSUSE-SU-2024:14100-1"],"status":"published","title":"Integer overflow in libvpx","description":"There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond","severity":{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00814,"percentile":0.573,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2024-06-03T13:30:26Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"libvpx","fixed_in":["1.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libvpx","fixed_in":["1.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libvpx","fixed_in":["1.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libvpx","fixed_in":["1.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libvpx","fixed_in":["1.14.1-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libvpx","fixed_in":["1.9.0-8.el9_5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libvpx-devel","fixed_in":["1.9.0-8.el9_5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libvpx","fixed_in":["1.9.0-7.el9_2.alma.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libvpx-devel","fixed_in":["1.9.0-7.el9_2.alma.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libvpx-utils","fixed_in":["1.9.0-7.el9_2.alma.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libvpx","fixed_in":["1.9.0-9.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libvpx-devel","fixed_in":["1.9.0-9.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libvpx-utils","fixed_in":["1.9.0-9.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libvpx","fixed_in":["1.12.0-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libvpx","fixed_in":["1.14.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libvpx","fixed_in":["1.14.1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"libvpx","fixed_in":["1.7.0-3+deb10u3"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"libvpx","fixed_in":["1.9.0-1+deb11u3"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibVPX_jll","fixed_in":["1.15.2+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"libvpx","fixed_in":["1.12.0-1.3.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libvpx","fixed_in":["1.7.0-11.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"libvpx","fixed_in":["1.7.0-12.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"libvpx","fixed_in":["1.7.0-12.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"libvpx","fixed_in":["1.13.1-2.oe2403"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libvpx","fixed_in":["0:1.9.0-8.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libvpx-debuginfo","fixed_in":["0:1.9.0-8.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libvpx-debugsource","fixed_in":["0:1.9.0-8.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libvpx-utils-debuginfo","fixed_in":["0:1.9.0-8.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libvpx-debuginfo","fixed_in":["0:1.9.0-8.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libvpx-debugsource","fixed_in":["0:1.9.0-8.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libvpx-devel","fixed_in":["0:1.9.0-8.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libvpx-utils-debuginfo","fixed_in":["0:1.9.0-8.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libvpx","fixed_in":["0:1.9.0-7.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libvpx-debuginfo","fixed_in":["0:1.9.0-7.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libvpx-debugsource","fixed_in":["0:1.9.0-7.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libvpx-utils-debuginfo","fixed_in":["0:1.9.0-7.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libvpx","fixed_in":["0:1.9.0-7.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libvpx-debuginfo","fixed_in":["0:1.9.0-7.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libvpx-debugsource","fixed_in":["0:1.9.0-7.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libvpx-utils-debuginfo","fixed_in":["0:1.9.0-7.el9_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libvpx","fixed_in":["0:1.9.0-7.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libvpx-debuginfo","fixed_in":["0:1.9.0-7.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libvpx-debugsource","fixed_in":["0:1.9.0-7.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libvpx-utils-debuginfo","fixed_in":["0:1.9.0-7.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libvpx-debuginfo","fixed_in":["0:1.9.0-7.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libvpx-debugsource","fixed_in":["0:1.9.0-7.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libvpx-devel","fixed_in":["0:1.9.0-7.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libvpx-utils-debuginfo","fixed_in":["0:1.9.0-7.el9_4.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"libvpx","fixed_in":["0:1.9.0-8.el9_5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libvpx","fixed_in":["1.3.0-2ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libvpx","fixed_in":["1.5.0-2ubuntu1.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libvpx","fixed_in":["1.7.0-3ubuntu0.18.04.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libvpx","fixed_in":["1.8.2-1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libvpx","fixed_in":["1.11.0-2ubuntu2.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libvpx","fixed_in":["1.14.0-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libvpx","fixed_in":["1.14.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libvpx-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-8.el9_5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libvpx-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-8.el9_5"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.13.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.13.1-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-7.el9_2.alma.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libvpx-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-7.el9_2.alma.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libvpx-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-7.el9_2.alma.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-9.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libvpx-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-9.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libvpx-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-9.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-1+deb12u3"}]}],"versions":["1.12.0-1","1.12.0-1+deb12u1","1.12.0-1+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-3+deb10u3"}]}],"versions":["1.7.0-3","1.7.0-3+deb10u1","1.7.0-3+deb10u2"]},{"source":"osv","ecosystem":"Debian:11","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-1+deb11u3"}]}],"versions":["1.9.0-1","1.9.0-1+deb11u1","1.9.0-1+deb11u2"]},{"source":"osv","ecosystem":"Debian:12","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-1+deb12u3"}]}],"versions":["1.12.0-1","1.12.0-1+deb12u1","1.12.0-1+deb12u2"]},{"source":"osv","ecosystem":"Julia","package":"LibVPX_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.2+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-1.3.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-11.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-12.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-12.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-2.oe2403"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvpx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvpx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvpx-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvpx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvpx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvpx-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvpx-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-8.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libvpx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-8.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libvpx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-8.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libvpx-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-8.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libvpx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-8.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libvpx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-8.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libvpx-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-8.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libvpx-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-8.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-7.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libvpx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-7.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libvpx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-7.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libvpx-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-7.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-7.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libvpx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-7.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libvpx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-7.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libvpx-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-7.el9_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-7.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libvpx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-7.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libvpx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-7.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libvpx-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-7.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libvpx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-7.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libvpx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-7.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libvpx-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-7.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libvpx-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-7.el9_4.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-8.el9_5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150000.6.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150000.6.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150000.6.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150000.6.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150000.6.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150000.6.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150000.6.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150000.6.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150000.6.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150000.6.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150000.6.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150000.6.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150000.6.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150400.3.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150400.3.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150400.3.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150400.3.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150400.3.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150400.3.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150400.3.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150400.3.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150400.3.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150400.3.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150400.3.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150400.3.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2ubuntu0.1+esm3"}]}],"versions":["1.2.0-2","1.3.0-1","1.3.0-2","1.3.0-2ubuntu0.1~esm1","1.3.0-2ubuntu0.1~esm2","1.3.0-2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-2ubuntu1.1+esm3"}]}],"versions":["1.4.0-4","1.5.0-2","1.5.0-2ubuntu1","1.5.0-2ubuntu1.1","1.5.0-2ubuntu1.1+esm1","1.5.0-2ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-3ubuntu0.18.04.1+esm2"}]}],"versions":["1.6.1-3","1.7.0-3","1.7.0-3ubuntu0.18.04.1","1.7.0-3ubuntu0.18.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-1ubuntu0.3"}]}],"versions":["1.8.1-2","1.8.2-1","1.8.2-1build1","1.8.2-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-2ubuntu2.3"}]}],"versions":["1.9.0-1ubuntu1","1.11.0-2ubuntu1","1.11.0-2ubuntu2","1.11.0-2ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-1ubuntu2.1"}]}],"versions":["1.12.0-1ubuntu2","1.13.1-2ubuntu1","1.14.0-1ubuntu1","1.14.0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-1ubuntu0.3"}]}],"versions":["1.8.1-2","1.8.2-1","1.8.2-1build1","1.8.2-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-2ubuntu2.3"}]}],"versions":["1.9.0-1ubuntu1","1.11.0-2ubuntu1","1.11.0-2ubuntu2","1.11.0-2ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-1ubuntu2.1"}]}],"versions":["1.12.0-1ubuntu2","1.13.1-2ubuntu1","1.14.0-1ubuntu1","1.14.0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2ubuntu0.1+esm3"}]}],"versions":["1.2.0-2","1.3.0-1","1.3.0-2","1.3.0-2ubuntu0.1~esm1","1.3.0-2ubuntu0.1~esm2","1.3.0-2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-2ubuntu1.1+esm3"}]}],"versions":["1.4.0-4","1.5.0-2","1.5.0-2ubuntu1","1.5.0-2ubuntu1.1","1.5.0-2ubuntu1.1+esm1","1.5.0-2ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-3ubuntu0.18.04.1+esm2"}]}],"versions":["1.6.1-3","1.7.0-3","1.7.0-3ubuntu0.18.04.1","1.7.0-3ubuntu0.18.04.1+esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-1.1"}]}]}],"products":[{"vendor":"chromium","product":"libvpx"},{"vendor":"debian","product":"debian_linux"},{"vendor":"google","product":"libvpx"},{"vendor":"webmproject","product":"libvpx"}],"references":[{"url":"https://g-issues.chromium.org/issues/332382766","tags":["x_transferred","Exploit","Issue Tracking","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00005.html","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5197","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4h58-f788-v8pw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-5197","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5941","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-6349","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-5197","tags":["report"]},{"url":"https://bugzilla.redhat.com/2283553","tags":["report"]},{"url":"https://bugzilla.redhat.com/2291198","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-5941.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9827","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9827.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1755003990.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1777973407.html","tags":["advisory"]},{"url":"https://chromium.googlesource.com","tags":["web"]},{"url":"https://chromium.googlesource.com/webm/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5197.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-5197","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0221.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33281","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6814-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1716","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2283553","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2291198","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5941.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-6349","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6349","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-5197","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9827.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14138","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14138.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14139","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14139.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14140","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14140.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:5941","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9827","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242408-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1225403","tags":["report"]},{"url":"https://bugzilla.suse.com/1225879","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-5197","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242409-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216879","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44488","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-5197","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7249-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-5197","title":"Integer overflow in libvpx","description":"There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond","status":"published","published":"2024-06-03T13:30:26.925Z","modified":"2025-02-13T17:54:05.905Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:34:00.929382Z"}],"euvd":[{"id":"EUVD-2024-46440","description":"There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond","status":"published","published":"2024-06-03T13:30:26Z","modified":"2025-02-13T17:54:05Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:53:31.305109Z"}],"ghsa":[{"id":"GHSA-4h58-f788-v8pw","title":"There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc()...","description":"There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond","status":"published","published":"2024-06-03T15:31:00Z","modified":"2025-07-22T18:31:43Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:03:05.693325Z"}],"nvd":[{"id":"CVE-2024-5197","description":"There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond","status":"published","published":"2024-06-03T14:15:09.52Z","modified":"2026-06-17T08:15:23.497Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:10:03.465199Z"}],"osv":[{"id":"ALPINE-CVE-2024-5197","description":"There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond","status":"published","published":"2024-06-03T14:15:09.52Z","modified":"2026-11-03T06:32:50.184814574Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2024-5197","title":"Integer overflow in libvpx","description":"There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond","status":"published","published":"2024-06-03T13:30:26.925Z","modified":"2026-10-28T02:30:52.12220765Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"DEBIAN-CVE-2024-5197","description":"There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond","status":"published","published":"2024-06-03T14:15:09.52Z","modified":"2026-11-02T12:03:07.078753388Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:44.117337Z"},{"id":"JLSEC-2026-377","description":"There exists interger overflows in libvpx in versions prior to 1.14.1. Calling `vpx_img_alloc()` with a large value of the `d_w`, `d_h`, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned `vpx_image_t` struct may be invalid. Calling `vpx_img_wrap()` with a large value of the `d_w`, `d_h`, or `stride_align` parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned `vpx_image_t` struct may be invalid. We recommend upgrading to version 1.14.1 or beyond","status":"published","published":"2026-05-01T13:54:10.329Z","modified":"2026-07-25T18:24:23.613345904Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"},{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2024-1716","title":"libvpx security update","description":"libvpx provides the VP8/VP9 SDK, which allows you to integrate your applications with the VP8 and VP9 video codecs, high quality, royalty free, open source codecs deployed on millions of computers and devices worldwide.\r\n\r\nSecurity Fix(es):\r\n\r\nThere exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond(CVE-2024-5197)","status":"published","published":"2024-06-14T11:07:10Z","modified":"2026-08-18T01:17:24.245356626Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2024:5941","title":"Red Hat Security Advisory: libvpx security update","status":"published","published":"2024-09-16T21:14:43Z","modified":"2026-06-26T12:22:32.370587866Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:9827","title":"Red Hat Security Advisory: libvpx security update","status":"published","published":"2024-11-25T09:52:32Z","modified":"2026-06-26T12:22:06.021865602Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:14138","title":"Red Hat Security Advisory: libvpx security update","status":"published","published":"2025-08-21T10:03:50Z","modified":"2026-03-18T11:38:35.598545Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14139","title":"Red Hat Security Advisory: libvpx security update","status":"published","published":"2025-08-20T10:03:59Z","modified":"2026-03-18T11:38:34.899933Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14140","title":"Red Hat Security Advisory: libvpx security update","status":"published","published":"2025-08-21T10:03:52Z","modified":"2026-06-26T12:22:42.888288031Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RLSA-2024:5941","title":"Moderate: libvpx security update","description":"The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.\n\nSecurity Fix(es):\n\n* libvpx: Heap buffer overflow related to VP9 encoding (CVE-2023-6349)\n\n* libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-17T00:54:54.665652Z","modified":"2026-02-05T04:45:08.096849Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:9827","title":"Moderate: libvpx security update","description":"The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.\n\nSecurity Fix(es):\n\n* libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-03-17T20:16:45.510776Z","modified":"2025-10-09T06:18:59.095631Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2024-5197","description":"There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond","status":"published","published":"2024-06-03T14:15:00Z","modified":"2026-04-22T15:17:50.924996Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:11.182485Z"},{"id":"ALSA-2024:5941","title":"Moderate: libvpx security update","description":"The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.\n\nSecurity Fix(es):\n\n* libvpx: Heap buffer overflow related to VP9 encoding (CVE-2023-6349)\n* libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-08-28T00:00:00Z","modified":"2026-10-29T11:02:21.751901119Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:9827","title":"Moderate: libvpx security update","description":"The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.  \n\nSecurity Fix(es):  \n\n  * libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-11-18T00:00:00Z","modified":"2026-10-29T11:32:12.218492871Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"AZL-42958","title":"CVE-2024-5197 affecting package libvpx 1.13.1-1","description":"There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond","status":"published","published":"2024-06-03T14:15:09Z","modified":"2026-04-21T04:30:50.430821Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-42963","title":"CVE-2024-5197 affecting package libvpx 1.13.1-1","description":"There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond","status":"published","published":"2024-06-03T14:15:09Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:19.893001Z"},{"id":"CLSA-2025-1755003990","title":"libvpx: Fix of CVE-2024-5197","description":"- CVE-2024-5197: fix integer overflows in image allocation\n  and wrapping logic, validate dimensions and alignment to prevent\n  invalid buffer calculations","status":"published","published":"2025-08-12T13:06:34Z","modified":"2026-06-01T00:31:12.04737159Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2026-1777973407","title":"libvpx: Fix of CVE-2024-5197","description":"- CVE-2024-5197: fix integer overflows in image allocation and wrapping logic","status":"published","published":"2026-05-05T09:30:11Z","modified":"2026-06-01T00:32:51.213043902Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-3830-1","title":"libvpx - security update","status":"published","published":"2024-06-16T00:00:00Z","modified":"2026-03-09T01:18:05.562069Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5722-1","title":"libvpx - security update","status":"published","published":"2024-06-26T00:00:00Z","modified":"2026-03-09T02:11:44.702984Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0221","title":"Updated libvpx packages fix security vulnerabilities","description":"There exists integer overflows in libvpx in versions prior to 1.14.1.\nCalling vpx_img_alloc() with a large value of the d_w, d_h, or align\nparameter may result in integer overflows in the calculations of buffer\nsizes and offsets and some fields of the returned vpx_image_t struct may\nbe invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h,\nor stride_align parameter may result in integer overflows in the\ncalculations of buffer sizes and offsets and some fields of the returned\nvpx_image_t struct may be invalid. (CVE-2024-5197)\n","status":"published","published":"2024-06-14T17:30:25Z","modified":"2026-04-16T04:44:40.300553725Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14100-1","title":"libvpx-devel-1.14.1-1.1 on GA media","description":"These are all security issues fixed in the libvpx-devel-1.14.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-04T00:00:00Z","modified":"2025-05-07T18:16:23.188649Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:2408-1","title":"Security update for libvpx","description":"This update for libvpx fixes the following issues:\n\n- CVE-2024-5197: Fixed interger overflow when calling vpx_img_alloc() or vpx_img_wrap() with large parameters (bsc#1225879).\n- CVE-2023-6349: Fixed heap overflow when encoding a frame that has larger dimensions than the originally configured size (bsc#1225403).\n","status":"published","published":"2024-07-11T11:52:00Z","modified":"2026-02-04T03:44:50.791511Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2409-1","title":"Security update for libvpx","description":"This update for libvpx fixes the following issues:\n\n- CVE-2024-5197: Fixed interger overflow when calling vpx_img_alloc() or vpx_img_wrap() with large parameters (bsc#1225879).\n- CVE-2023-6349: Fixed heap overflow when encoding a frame that has larger dimensions than the originally configured size (bsc#1225403).\n- CVE-2023-44488: Fixed heap buffer overflow in vp8 encoding (bsc#1216879).\n","status":"published","published":"2024-07-11T11:55:25Z","modified":"2026-02-04T02:56:04.533845Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"USN-6814-1","title":"libvpx vulnerability","description":"Xiantong Hou discovered that libvpx did not properly handle certain\nmalformed media files. If an application using libvpx opened a specially\ncrafted file, a remote attacker could cause a denial of service, or\npossibly execute arbitrary code.\n","status":"published","published":"2024-06-06T16:43:22Z","modified":"2026-04-22T10:47:34.549055Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-7249-1","title":"libvpx vulnerability","description":"Xiantong Hou discovered that libvpx would overflow when attempting to\nallocate memory for very large images. If an application using libvpx\nopened a specially crafted file, a remote attacker could possibly use\nthis issue to cause the application to crash, resulting in a denial\nof service, or the execution of arbitrary code.\n","status":"published","published":"2025-02-03T14:22:19Z","modified":"2026-06-25T13:32:30.068295074Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}