USN-6403-2: libvpx vulnerabilities

24012

04 December 2023

04 December 2023

CLOSED

MEDIUM

CVE-2023-44488,CVE-2023-5217

Severity

medium

Vendor

VMware Tanzu

Versions Affected

  • Canonical Ubuntu 18.04

Description

USN-6403-1 fixed several vulnerabilities in libvpx. This update provides the corresponding update for Ubuntu 18.04 LTS. Original advisory details: It was discovered that libvpx did not properly handle certain malformed media files. If an application using libvpx opened a specially crafted file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. Update Instructions: Run `sudo pro fix USN-6403-2` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: libvpx-dev - 1.7.0-3ubuntu0.18.04.1+esm1 vpx-tools - 1.7.0-3ubuntu0.18.04.1+esm1 libvpx-doc - 1.7.0-3ubuntu0.18.04.1+esm1 libvpx5 - 1.7.0-3ubuntu0.18.04.1+esm1 Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro

CVEs contained in this USN include: CVE-2023-44488, CVE-2023-5217

Affected VMware Products and Versions

Severity is medium unless otherwise noted.

  • Isolation Segment
    • 2.11.x versions prior to 2.11.42
    • 2.13.x versions prior to 2.13.27
    • 3.0.x versions prior to 3.0.20
    • 4.0.x versions prior to 4.0.12+LTS-T
  • VMware Tanzu Application Service for VMs
    • 2.11.x versions prior to 2.11.48
    • 2.13.x versions prior to 2.13.30
    • 3.0.x versions prior to 3.0.20
    • 4.0.x versions prior to 4.0.12+LTS-T

Mitigation

Users of affected products are strongly encouraged to follow the mitigation below. On the Tanzu Network product page for each release, check the Depends On section and/or Release Notes for this information. Releases that have fixed this issue include:
  • Isolation Segment
    • 2.11.42
    • 2.13.27
    • 3.0.20
    • 4.0.12+LTS-T
  • VMware Tanzu Application Service for VMs
    • 2.11.48
    • 2.13.30
    • 3.0.20
    • 4.0.12+LTS-T

References

History

2023-12-04: Initial vulnerability report published.