VP8/VP9's libvpx 1.13.1 Released Due To A High Severity Vulnerability

Written by Michael Larabel in Multimedia on 30 September 2023 at 06:02 AM EDT. 23 Comments
Google on Friday released libvpx 1.13.1 as the newest update to this open-source reference encoder for the VP8 and VP9 video codecs. This release is coming due to CVE-2023-5217, which is a "high" severity vulnerability that's been exploited within at least the Google Chrome web browser.

CVE-2023-5217 is due to a heap buffer overflow within the VP8 encoding path in libvpx used by Google Chrome. With prior Chrome versions and pre-1.13.1 for libvpx, a remote attacker could potentially exploit heap corruption via a specially crafted HTML page. Google is aware of an exploit for this vulnerability existing in the wild.

VP8 codec logo

Details on this security vulnerability can be found via the oss-security list.

Released on Friday night was the libvpx 1.13.1 update with this security fix for CVE-2023-5217 as well as a crash related to VP9 encoding.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com.

Popular News This Week