CVE-2015-1258

Publication date 20 May 2015

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via a crafted frame size in VP9 video data.

Read the notes from the security team

Status

Package Ubuntu Release Status
chromium-browser 15.10 wily
Fixed 43.0.2357.81-0ubuntu1.1179
15.04 vivid
Fixed 43.0.2357.81-0ubuntu0.15.04.1.1170
14.10 utopic
Fixed 43.0.2357.81-0ubuntu0.14.10.1.1131
14.04 LTS trusty
Fixed 43.0.2357.81-0ubuntu0.14.04.1.1089
12.04 LTS precise Ignored
libvpx 15.10 wily
Not affected
15.04 vivid
Not affected
14.10 utopic
Not affected
14.04 LTS trusty
Not affected
12.04 LTS precise
Not affected
oxide-qt 15.10 wily
Fixed 1.7.8-0ubuntu1
15.04 vivid
Fixed 1.7.8-0ubuntu0.15.04.1
14.10 utopic
Fixed 1.7.8-0ubuntu0.14.10.1
14.04 LTS trusty
Fixed 1.7.8-0ubuntu0.14.04.1
12.04 LTS precise Not in release

Notes

mdeslaur

build parameter is specific for chrome build

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
libvpx