In mv_err_cost of mcomp.c there is a possible out of bounds read due to missing bounds check. This could lead to denial of service with no additional execution privileges needed. User interaction is needed for exploitation.

According to the version of the libvpx package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Disclaimer: The entry creation date may reflect when     the CVE ID was allocated or reserved, and does not     necessarily indicate when this vulnerability was     discovered, shared with the affected vendor, publicly     disclosed, or updated in CVE(CVE-2018-9349)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvpx package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A denial of service vulnerability in libvpx in     Mediaserver could enable a remote attacker to use a     specially crafted file to cause a device hang or     reboot. This issue is rated as High due to the     possibility of remote denial of service. Product:
    Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1,     7.0, 7.1. Android ID: A-30436808.(CVE-2017-0393)

  - In libvpx, there is a possible information disclosure     due to improper input validation. This could lead to     remote information disclosure with no additional     execution privileges needed. User interaction is needed     for exploitation. Product: AndroidVersions:
    Android-10Android ID: A-80479354(CVE-2019-9433)

  - libvpx contains an out-of-bounds read flaw in the     vp8_mv_bit_cost() and mv_err_cost() functions in     vp8/encoder/mcomp.c that is triggered as certain input     is not properly validated. This may allow a     context-dependent attacker to crash a process linked     against the library or potentially disclose sensitive     memory contents.(CVE-2018-9349)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libvpx package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Disclaimer: The entry creation date may reflect when     the CVE ID was allocated or reserved, and does not     necessarily indicate when this vulnerability was     discovered, shared with the affected vendor, publicly     disclosed, or updated in CVE.(CVE-2018-9349)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libvpx package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - libvpx provides the VP8/VP9 SDK, which allows you to     integrate your applications with the VP8 and VP9 video     codecs, high quality, royalty free, open source codecs     deployed on millions of computers and devices     worldwide.Security Fix(es):Disclaimer: The entry     creation date may reflect when the CVE ID was allocated     or reserved, and does not necessarily indicate when     this vulnerability was discovered, shared with the     affected vendor, publicly disclosed, or updated in     CVE.(CVE-2018-9349)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
153332	EulerOS 2.0 SP2 : libvpx (EulerOS-SA-2021-2402)	Nessus	Huawei Local Security Checks	medium
149125	EulerOS 2.0 SP3 : libvpx (EulerOS-SA-2021-1814)	Nessus	Huawei Local Security Checks	medium
137027	EulerOS 2.0 SP5 : libvpx (EulerOS-SA-2020-1609)	Nessus	Huawei Local Security Checks	medium
134019	EulerOS 2.0 SP8 : libvpx (EulerOS-SA-2020-1185)	Nessus	Huawei Local Security Checks	medium

Detections

Analytics

CVE-2018-9349

medium

Tenable Plugins

medium

medium

medium

medium