Fluid Attacks Database

Description

In vp8_decode_frame of decodeframe.c, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure if error correction were turned on, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1Android ID: A-62458770

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	libvpx	>=0 <1.7.0-3	1.7.0-3
alpine v3.11	libvpx	=0.9.1-r0 \|\| =0.9.2-r0 \|\| =0.9.5-r0 \|\| =0.9.6-r0 \|\| =0.9.6-r1 \|\| =0.9.7-r0 \|\| =0.9.7_p1-r0 \|\| =1.0.0-r0 \|\| =1.1.0-r0 \|\| =1.1.0-r1 \|\| =1.2.0-r0 \|\| =1.3.0-r0 \|\| =1.3.0-r1 \|\| =1.3.0-r2 \|\| =1.4.0-r0 \|\| =1.4.0-r1 \|\| =1.5.0-r0 \|\| =1.6.1-r0 \|\| =1.6.1-r1 \|\| =1.8.0-r0 \|\| =1.8.1-r0 \|\| >=0 <1.8.2-r0	1.8.2-r0
debian 11	libvpx	>=0 <1.7.0-3	1.7.0-3
debian 12	libvpx	>=0 <1.7.0-3	1.7.0-3
debian 14	libvpx	>=0 <1.7.0-3	1.7.0-3
rpm rhel7	libvpx	<0:1.3.0-8.el7	0:1.3.0-8.el7
rpm rhel6	libvpx	-	-

Aliases

1. CVE-2020-00342. NVD-2020-00343. OSV-DEBIAN-2020-00344. OSV-2020-00345. OSV-ALPINE-2020-00346. SECURITY-TRACKER-CVE-2020-00347. SECURITY-CVE-2020-0034

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.