CVE-2012-0823 VP8 Codec SDK (libvpx) before 1.0.0 "Duclair" allows remote attackers to cause a denial of service (application crash) via (1) unspecified "corrupt input" or (2) by "starting decoding from a P-frame,"...
MediumCVSS 5.0
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
VP8 Codec SDK (libvpx) before 1.0.0 "Duclair" allows remote attackers to cause a denial of service (application crash) via (1) unspecified "corrupt input" or (2) by "starting decoding from a P-frame," which triggers an out-of-bounds read, related to "the clamping of motion vectors in SPLITMV blocks".
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libvpx(Debian:12) | < 1.0.0-1 | 1.0.0-1 |
| debian/libvpx(Debian:13) | < 1.0.0-1 | 1.0.0-1 |
| debian/libvpx(Debian:14) | < 1.0.0-1 | 1.0.0-1 |
| webmproject libvpx | <= 0.9.7 | No fix listed |
| webmproject libvpx | = 0.9.0 | No fix listed |
| webmproject libvpx | = 0.9.1 | No fix listed |
| webmproject libvpx | = 0.9.2 | No fix listed |
| webmproject libvpx | = 0.9.5 | No fix listed |
| webmproject libvpx | = 0.9.6 | No fix listed |
| webmproject libvpx | = 0.9.7 | No fix listed |
References
- Debian Security Tracker CVE-2012-0823 vendor-advisory
- blog.webmproject.org
- code.google.com
- MDVSA-2012:023 vendor-advisory
- [oss-security] 20120128 (maybe) CVE request: libvpx before 1.0 crasher mailing-list
- [oss-security] 20120129 Re: (maybe) CVE request: libvpx before 1.0 crasher mailing-list
- 51775 vdb-entry