aom vulnerabilities

heap buffer overflow in libaom

Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers: * Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid. * Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid. * Calling aom_img_alloc_with_border() with a

• Update to 1.0.0.errata1-3+deb11u1ubuntu0.1

heap buffer overflow in libaom

Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc().

CVE-2020-36135

AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.

• Update to 1.0.0.errata1-3+deb11u1build0.20.04.1

CVE-2020-36133

AOM v2.0.1 was discovered to contain a global buffer overflow via the component av1/encoder/partition_search.h.

• Update to 1.0.0.errata1-3+deb11u1build0.20.04.1

CVE-2020-36131

AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.

• Update to 1.0.0.errata1-3+deb11u1build0.20.04.1

CVE-2020-36130

AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.

• Update to 1.0.0.errata1-3+deb11u1build0.20.04.1

CVE-2020-36129

AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.

CVE-2021-30475

aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow.

• Update to 1.0.0.errata1-3+deb11u1build0.20.04.1

CVE-2021-30474

aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.

• Update to 1.0.0.errata1-3+deb11u1build0.20.04.1

CVE-2021-30473

aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.

• Update to 1.0.0.errata1-3+deb11u1build0.20.04.1

CVE-2019-2126

In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368.