# CVE-2019-9232: libvpx: The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used...

CVE-2019-9232 is fixed in 4 products on 1 platform, first by libvpx5 1.7.0-3ubuntu0.18.04.1, released September 27, 2019. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2019-9232
- Priority: High
- CVSS: 7.5 (Moderate)
- EPSS: 0.0509
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 27, 2019

## Description

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.  Security Fix(es):  * libvpx: Double free in ParseContentEncodingEntry() in mkvparser.cc (CVE-2019-2126)  * libvpx: Out of bounds read in vp8_norm table (CVE-2019-9232)  * libvpx: Resource exhaustion after memory leak in mkvparser.cc (CVE-2019-9371)  * libvpx: Use-after-free in vp8_deblock() in vp8/common/postproc.c (CVE-2019-9433)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  Additional Changes:  For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libvpx RHEL 8 | 0:1.7.0-8.el8 | [RHSA-2020:4629](https://patchblox.com/security/data/fix/linux/rhsa-2020-4629.md) | Nov 4, 2020 |
| Linux | libvpx ol 8 | 0:1.7.0-8.el8 | [ELSA-2020-4629](https://patchblox.com/security/data/fix/linux/elsa-2020-4629.md) | Nov 10, 2020 |
| Linux | libvpx-devel RHEL 8 | 0:1.7.0-8.el8 | [RHSA-2020:4629](https://patchblox.com/security/data/fix/linux/rhsa-2020-4629.md) | Nov 4, 2020 |
| Linux | libvpx-devel ol 8 | 0:1.7.0-8.el8 | [ELSA-2020-4629](https://patchblox.com/security/data/fix/linux/elsa-2020-4629.md) | Nov 10, 2020 |
| Linux | libvpx5 Ubuntu 18.04.6 LTS (bionic) | 1.7.0-3ubuntu0.18.04.1 | [libvpx5 1.7.0-3ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libvpx5-1.7.0-3ubuntu0.18.04.1.md) | Sep 27, 2019 |
| Linux | vpx-tools Ubuntu 18.04.6 LTS (bionic) | 1.7.0-3ubuntu0.18.04.1 | [vpx-tools 1.7.0-3ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-vpx-tools-1.7.0-3ubuntu0.18.04.1.md) | Sep 27, 2019 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo