#BSI WID-SEC-2024-1945: [NEU] [mittel] #Red #Hat #Enterprise #Linux (#libvpx): Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in der Komponente libvpx ausnutzen, um einen Denial of Service Angriff durchzuführen.

https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1945

FFmpeg libaom (libaom-av1) is the reference encoder for the AV1 format. It was also used for research during the development of AV1. libaom is based on libvpx and thus shares many of its characteristics in terms of features, performance, and usage.

To install FFmpeg with support for libaom-av1, look at the Compilation Guides and compile FFmpeg with the --enable-libaom option.

https://ffmpeg.org/ffmpeg-codecs.html#libaom_002dav1
https://trac.ffmpeg.org/wiki/CompilationGuide

#ffmpeg #av1 #vp9 #libaom #libvpx #AOMedia

Patch Tuesday, October 2023 Edition

https://krebsonsecurity.com/2023/10/patch-tuesday-october-2023-edition/

#PatchTuesdayOctober2023 #RapidResetAttack #SkypeforBusiness #CVE-2023-35349 #CVE-2023-36563 #CVE-2023-36778 #CVE-2023-41763 #CVE-2023-44487 #DamianMenscher #SecurityTools #ImmersiveLabs #iPadOS17.0.3 #NatalieSilva #TimetoPatch #AdamBarnett #CloudFlare #iOS17.0.3 #microsoft #windows #Wordpad #Amazon #google #libvpx #Rapid7 #apple

CISA warned that a vulnerability affecting open source tool libvpx is being exploited

Incident responders and experts at several companies said the WS_FTP Server vulnerabilities are being exploited as well

#libvpx #WSFTP

https://therecord.media/libvpx-ws-ftp-vulnerabilities-browsers-file-transfer-tool

Just saw patched #libvpx packages hit #Ubuntu repositories

#libvpx6 on Focal (1.8.2-1ubuntu0.2)

#libvpx7 on Jammy (1.11.0-2ubuntu2.2), Lunar (1.12.0-1ubuntu1.2)

Nothing yet on the packaged Firefox in Focal repository

https://ubuntu.com/security/CVE-2023-5217

cc @viking

Looks like an updated #libvpx package is now in #Debian repositories for stable (Bookworm) and oldstable (Bullseye)!

Updated #Chromium packages are available as well;

however, Debian builds of #Firefox ESR are still at 118.0 so be cautious, noting as I mentioned here that the package that showed up yesterday was in fact for a new upstream build already underway before the security patch and is for 115.3.0 - NOT 115.3.1 that includes the patch for CVE-2023-5217

https://mastodon.online/@topher/111144418044781039

New 0-day, this time on "libvpx". Affects Chrome, Firefox and many more apps.

https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/

#security #chrome #firefox #libvpx

Woohoo, another day, another #0day like the #libwebp one, this time in #libvpx: https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/

Let the purge / patch crunch begin!