Out-of-bounds read in libvpx - CVE-2019-9325
Published: November 29, 2019 / Updated: December 20, 2019
Vulnerability identifier: #VU23104
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-9325
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a missing bounds check when processing media content in libvpx. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.
Affected software
libvpx
Gentoo Linux
Opensuse
Fedora
libvpx (Debian package)
libvpx (Alpine package)
libvpx
Gentoo Linux
Opensuse
Fedora
libvpx (Debian package)
libvpx (Alpine package)
libvpx
How to mitigate CVE-2019-9325
Install update from vendor's website.
libvpx - update to 1.8.2
libvpx (Debian package) - addressed in versions 1.6.1-3+deb9u2, 1.7.0-3+deb10u1
libvpx - addressed in versions 1.8.2-1.fc30, 1.8.2-1.fc31
libvpx (Debian package) - addressed in versions 1.6.1-3+deb9u2, 1.7.0-3+deb10u1
libvpx - addressed in versions 1.8.2-1.fc30, 1.8.2-1.fc31