Security update for libvpx SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1297-1 Final 1 1 2020-05-18T05:42:28Z current 2020-05-18T05:42:28Z 2020-05-18T05:42:28Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libvpx This update for libvpx fixes the following issues: - CVE-2020-0034: Fixed an out-of-bounds read on truncated key frames (bsc#1166066). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-1297,SUSE-SLE-Module-Basesystem-15-SP1-2020-1297,SUSE-SLE-Module-Desktop-Applications-15-SP1-2020-1297,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-1297 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201297-1/ Link for SUSE-SU-2020:1297-1 https://lists.suse.com/pipermail/sle-security-updates/2020-May/006827.html E-Mail link for SUSE-SU-2020:1297-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1166066 SUSE Bug 1166066 https://www.suse.com/security/cve/CVE-2020-0034/ SUSE CVE CVE-2020-0034 page SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 libvpx-devel-1.6.1-6.6.8 libvpx4-1.6.1-6.6.8 libvpx4-32bit-1.6.1-6.6.8 libvpx4-64bit-1.6.1-6.6.8 vpx-tools-1.6.1-6.6.8 libvpx4-1.6.1-6.6.8 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 libvpx-devel-1.6.1-6.6.8 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 In vp8_decode_frame of decodeframe.c, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure if error correction were turned on, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1Android ID: A-62458770 CVE-2020-0034 SUSE Linux Enterprise Module for Basesystem 15 SP1:libvpx4-1.6.1-6.6.8 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libvpx-devel-1.6.1-6.6.8 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201297-1/ https://www.suse.com/security/cve/CVE-2020-0034.html CVE-2020-0034 https://bugzilla.suse.com/1166066 SUSE Bug 1166066