CVE-2024-5197 | Critical | 9.1 | 2024-06-03 | There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may resul… |
CVE-2023-6349 | High | 7.5 | 2024-05-27 | A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap… |
CVE-2023-44488 | High | 7.5 | 2023-09-30 | VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. |
CVE-2023-5217 | High | 8.8 | 2023-09-28 | Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap… |
CVE-2023-4863 | High | 8.8 | 2023-09-12 | Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write v… |
CVE-2023-1999 | Medium | 5.3 | 2023-06-20 | There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best… |
CVE-2020-36332 | High | 7.5 | 2021-05-21 | A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threat from this vulnera… |
CVE-2020-36331 | Critical | 9.1 | 2021-05-21 | A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability i… |
CVE-2020-36330 | Critical | 9.1 | 2021-05-21 | A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerabil… |
CVE-2020-36329 | Critical | 9.8 | 2021-05-21 | A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early. The highest threat from this vulnerabi… |
CVE-2020-36328 | Critical | 9.8 | 2021-05-21 | A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer… |
CVE-2018-25014 | Critical | 9.8 | 2021-05-21 | A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol(). |
CVE-2018-25013 | Critical | 9.1 | 2021-05-21 | A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes(). |
CVE-2018-25012 | Critical | 9.1 | 2021-05-21 | A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24(). |
CVE-2018-25011 | Critical | 9.8 | 2021-05-21 | A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16(). |
CVE-2018-25010 | Critical | 9.1 | 2021-05-21 | A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter(). |
CVE-2018-25009 | Critical | 9.1 | 2021-05-21 | A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16(). |
CVE-2016-9969 | High | 7.5 | 2019-05-23 | In libwebp 0.5.1, there is a double free bug in libwebpmux. |
CVE-2019-9746 | High | 7.5 | 2019-03-13 | In libwebm before 2019-03-08, a NULL pointer dereference caused by the functions OutputCluster and OutputTracks in webm_info.cc will trigger an abort, which al… |
CVE-2018-19212 | Medium | 6.5 | 2018-11-12 | In libwebm through 2018-10-03, there is an abort caused by libwebm::Webm2Pes::InitWebmParser() that will lead to a DoS attack. |
CVE-2018-6548 | Critical | 9.8 | 2018-02-02 | A use-after-free issue was discovered in libwebm through 2018-02-02. If a Vp9HeaderParser was initialized once before, its property frame_ would not be changed… |
CVE-2018-6406 | High | 8.8 | 2018-01-30 | The function ParseVP9SuperFrameIndex in common/libwebm_util.cc in libwebm through 2018-01-30 does not validate the child_frame_length data obtained from a .web… |
CVE-2016-9085 | Low | 3.3 | 2017-02-03 | Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors. |
CVE-2012-0823 | | | 2012-02-23 | VP8 Codec SDK (libvpx) before 1.0.0 "Duclair" allows remote attackers to cause a denial of service (application crash) via (1) unspecified "corrupt input" or (… |
CVE-2010-4203 | Critical | 9.8 | 2010-11-06 | WebM libvpx (aka the VP8 Codec SDK) before 0.9.5, as used in Google Chrome before 7.0.517.44, allows remote attackers to cause a denial of service (memory corr… |