{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-5171", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "state": "PUBLISHED", "assignerShortName": "Google", "dateReserved": "2024-05-21T12:53:59.515Z", "datePublished": "2024-06-05T19:11:12.987Z", "dateUpdated": "2025-02-13T17:53:49.724Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "libaom", "repo": "https://aomedia.googlesource.com/aom/", "vendor": "libaom", "versions": [{"lessThan": "3.9.0", "status": "affected", "version": "1.0.0", "versionType": "custom"}]}], "datePublic": "2024-05-30T18:36:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Integer overflow in libaom internal function&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">img_alloc_helper</span> can lead to heap buffer overflow. This function can be reached via 3 callers:<br></p><ol><li>Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.</li><li><span style=\"background-color: var(--wht);\">Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.</span></li><li>Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.</li></ol><p></p>"}], "value": "Integer overflow in libaom internal function\u00a0img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:\n\n\n * Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n * Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n * Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2024-06-21T13:05:57.950Z"}, "references": [{"url": "https://issues.chromium.org/issues/332382766"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP/"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/U5NRNCEYS246CYGOR32MF7OGKWOWER22/"}], "source": {"discovery": "UNKNOWN"}, "title": "heap buffer overflow in libaom", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "libaom", "product": "libaom", "cpes": ["cpe:2.3:a:libaom:libaom:*:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "1.0.0", "status": "affected", "lessThan": "3.9.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-07T17:15:17.406236Z", "id": "CVE-2024-5171", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-07T17:16:49.921Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://issues.chromium.org/issues/332382766", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/U5NRNCEYS246CYGOR32MF7OGKWOWER22/", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00024.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-09-07T21:02:30.315Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://issues.chromium.org/issues/332382766", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/U5NRNCEYS246CYGOR32MF7OGKWOWER22/", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00024.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-09-07T21:02:30.315Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-5171", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-07T17:15:17.406236Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:libaom:libaom:*:*:*:*:*:*:*:*"], "vendor": "libaom", "product": "libaom", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "3.9.0", "versionType": "custom"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-07T17:16:38.643Z"}}], "cna": {"title": "heap buffer overflow in libaom", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://aomedia.googlesource.com/aom/", "vendor": "libaom", "product": "libaom", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "3.9.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2024-05-30T18:36:00.000Z", "references": [{"url": "https://issues.chromium.org/issues/332382766"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP/"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/U5NRNCEYS246CYGOR32MF7OGKWOWER22/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Integer overflow in libaom internal function\u00a0img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:\n\n\n * Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n * Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n * Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.", "supportingMedia": [{"type": "text/html", "value": "<p>Integer overflow in libaom internal function&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">img_alloc_helper</span> can lead to heap buffer overflow. This function can be reached via 3 callers:<br></p><ol><li>Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.</li><li><span style=\"background-color: var(--wht);\">Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.</span></li><li>Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.</li></ol><p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2024-06-05T19:11:12.987Z"}}}, "cveMetadata": {"cveId": "CVE-2024-5171", "state": "PUBLISHED", "dateUpdated": "2024-09-07T21:02:30.315Z", "dateReserved": "2024-05-21T12:53:59.515Z", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "datePublished": "2024-06-05T19:11:12.987Z", "assignerShortName": "Google"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:aomedia:libaom:*:*:*:*:*:*:*:*", "matchCriteriaId": "D74B12F6-84D4-40E2-B613-B88286CC61FC", "versionEndIncluding": "3.9.0", "versionStartIncluding": "1.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Integer overflow in libaom internal function\u00a0img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:\n\n\n * Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n * Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n * Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid."}, {"lang": "es", "value": "El desbordamiento de enteros en la funci\u00f3n interna de libaom img_alloc_helper puede provocar un desbordamiento del b\u00fafer del mont\u00f3n. Se puede acceder a esta funci\u00f3n a trav\u00e9s de 3 llamadores: * Llamar a aom_img_alloc() con un valor grande del par\u00e1metro d_w, d_h o align puede resultar en desbordamientos de enteros en los c\u00e1lculos de tama\u00f1os y compensaciones del b\u00fafer y algunos campos de la estructura aom_image_t devuelta pueden ser inv\u00e1lido. * Llamar a aom_img_wrap() con un valor grande del par\u00e1metro d_w, d_h o align puede provocar desbordamientos de enteros en los c\u00e1lculos de tama\u00f1os y compensaciones del b\u00fafer y algunos campos de la estructura aom_image_t devuelta pueden no ser v\u00e1lidos. * Llamar a aom_img_alloc_with_border() con un valor grande del par\u00e1metro d_w, d_h, align, size_align o border puede provocar desbordamientos de enteros en los c\u00e1lculos de tama\u00f1os y compensaciones del b\u00fafer y algunos campos de la estructura aom_image_t devuelta pueden no ser v\u00e1lidos."}], "id": "CVE-2024-5171", "lastModified": "2024-11-21T09:47:07.493", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "HIGH", "subsequentSystemIntegrity": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "HIGH", "vulnerableSystemConfidentiality": "HIGH", "vulnerableSystemIntegrity": "HIGH"}, "source": "[email protected]", "type": "Secondary"}]}, "published": "2024-06-05T20:15:13.800", "references": [{"source": "[email protected]", "tags": ["Exploit"], "url": "https://issues.chromium.org/issues/332382766"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP/"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/U5NRNCEYS246CYGOR32MF7OGKWOWER22/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://issues.chromium.org/issues/332382766"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00024.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/U5NRNCEYS246CYGOR32MF7OGKWOWER22/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-190"}], "source": "[email protected]", "type": "Primary"}]}

{"bugzilla": {"description": "libaom: Integer overflow in internal function\u00a0img_alloc_helper", "id": "2292396", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292396"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["Integer overflow in libaom internal function\u00a0img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:\n* Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n* Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n* Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.", "An integer overflow flaw was found in the libaom internal img_alloc_helper function. This issue can lead to a heap buffer overflow."], "name": "CVE-2024-5171", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "firefox:flatpak/firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "thunderbird:flatpak/thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "firefox:flatpak/firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-06-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-5171\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-5171\nhttps://issues.chromium.org/issues/332382766"], "statement": "Firefox and Thunderbird are likely not affected by this CVE. Similar to Chrome, they filter out values that are large enough to trigger the overflow before passing them to the underlying libraries.", "threat_severity": "Moderate"}