WebM libvpx (aka the VP8 Codec SDK) before 0.9.5, as used in Google Chrome before 7.0.517.44, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via invalid frames.

From Red Hat Security Advisory 2010:0999 :

Updated libvpx packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.

An integer overflow flaw, leading to arbitrary memory writes, was found in libvpx. An attacker could create a specially crafted video encoded using the VP8 codec that, when played by a victim with an application using libvpx (such as Totem), would cause the application to crash or, potentially, execute arbitrary code. (CVE-2010-4203)

All users of libvpx are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, all applications using libvpx must be restarted for the changes to take effect.

An integer overflow flaw, leading to arbitrary memory writes, was found in libvpx. An attacker could create a specially crafted video encoded using the VP8 codec that, when played by a victim with an application using libvpx (such as Totem), would cause the application to crash or, potentially, execute arbitrary code. (CVE-2010-4203)

After installing the update, all applications using libvpx must be restarted for the changes to take effect.

Update to libvpx 0.9.7-p1 Update to libvpx 0.9.7

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201101-03 (libvpx: User-assisted execution of arbitrary code)

    libvpx is vulnerable to an integer overflow vulnerability when     processing crafted VP8 video streams.
  Impact :

    A remote attacker could entice a user to open a specially crafted media     file, possibly resulting in the execution of arbitrary code with the     privileges of the user running the application, or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Updated libvpx packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.

An integer overflow flaw, leading to arbitrary memory writes, was found in libvpx. An attacker could create a specially crafted video encoded using the VP8 codec that, when played by a victim with an application using libvpx (such as Totem), would cause the application to crash or, potentially, execute arbitrary code. (CVE-2010-4203)

All users of libvpx are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, all applications using libvpx must be restarted for the changes to take effect.

Update to 0.9.5 and apply patch from upstream to resolve CVE-2010-4203 libvpx: memory corruption flaw.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Christoph Diehl discovered that libvpx did not properly perform bounds checking. If an application using libvpx opened a specially crafted WebM file, an attacker could cause a denial of service or possibly execute code as the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Google Chrome earlier than 7.0.517.44 are potentially affected by multiple vulnerabilities :

  - A use-after-free error exists in text editing. (51602)

  - A memory corruption error exists relating to enormous text area. (55257)

  - A bad cast exists with the SVG use element. (58657)

  - An invalid memory read exists in XPath handling. (58731)

  - A use-after-free error exists in text-control-selections. (58741)

  - Multiple integer overflows exists in font handling. (59320)

  - A memory corruption issue exists in libvpx. (60055)

  - A bad use of a destroyed frame object exists. (60238)

  - Multiple type confusions exists with event objects. (60327, 60769, 61255)

  - An out-of-bounds array access exists in SVG handling. (60688)

The version of Google Chrome installed on the remote host is earlier than 7.0.517.44.  Such versions are reportedly affected by multiple vulnerabilities :

  - A use-after-free error exists in text editing.
    (Issue #51602)

  - A memory corruption error exists relating to enormous     text area. (Issue #55257)

  - A bad cast exists with the SVG use element.
    (Issue #58657)

  - An invalid memory read exists in XPath handling.
    (Issue #58731)

  - A use-after-free error exists in text control     selections. (Issue #58741)

  - A memory corruption issue exists in libvpx.
    (Issue #60055)

  - A bad use of a destroyed frame object exists.
    (Issue #60238)

  - Multiple type confusions exists with event objects.
    (Issue #60327, #60769, #61255)

  - An out-of-bounds array access exists in SVG handling.
    (Issue #60688)

ID	Name	Product	Family	Severity
68168	Oracle Linux 6 : libvpx (ELSA-2010-0999)	Nessus	Oracle Linux Local Security Checks	critical
60926	Scientific Linux Security Update : libvpx on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
56146	Fedora 16 : libvpx-0.9.7.1-1.fc16 (2011-11057)	Nessus	Fedora Local Security Checks	high
51533	GLSA-201101-03 : libvpx: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
51354	RHEL 6 : libvpx (RHSA-2010:0999)	Nessus	Red Hat Local Security Checks	high
50834	Fedora 13 : libvpx-0.9.5-2.fc13 (2010-17893)	Nessus	Fedora Local Security Checks	high
50833	Fedora 14 : libvpx-0.9.5-2.fc14 (2010-17876)	Nessus	Fedora Local Security Checks	high
50559	Ubuntu 10.10 : libvpx vulnerability (USN-1015-1)	Nessus	Ubuntu Local Security Checks	high
800908	Google Chrome < 7.0.517.44 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
50476	Google Chrome < 7.0.517.44 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2010-4203

critical

Tenable Plugins

critical

high

high

critical

high

high

high

high

high

high