{"schemaVersion":3,"id":"CVE-2020-0034","aliases":["ALPINE-CVE-2020-0034","SUSE-SU-2020:1297-1","SUSE-SU-2020:1297-2","SUSE-SU-2021:4168-1","UBUNTU-CVE-2020-0034","USN-5637-1","DEBIAN-CVE-2020-0034","DLA-2136-1","DLA-2829-1","openSUSE-SU-2020:0680-1","openSUSE-SU-2024:11680-1"],"status":"published","duplicateOf":null,"title":null,"description":"In vp8_decode_frame of decodeframe.c, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure if error correction were turned on, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1Android ID: A-62458770","dates":{"published":"2020-03-10T19:56:04.000Z","modified":"2024-08-04T05:47:40.786Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:C/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"OSV · Alpine","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.8,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01945,"percentile":0.79898,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.01945},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01945,"percentile":0.79898}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01945,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01945,"percentile":0.79898}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-125","name":"Out-of-bounds Read","description":"The product reads data past the end, or before the beginning, of the intended buffer.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/125.html"}],"affected":[{"vendor":"alpine","product":"libvpx","name":"libvpx","label":"libvpx","ecosystem":"Alpine Linux","cpePart":null,"purl":"pkg:apk/alpine/libvpx","purlType":"apk","versions":[{"text":"< 1.8.2-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.8.2-r0","eol":null,"hubHref":null},{"vendor":"debian","product":"libvpx","name":"libvpx","label":"libvpx","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/libvpx","purlType":"deb","versions":[{"text":"< 1.7.0-3","noFixRecorded":false,"fixedIn":null},{"text":"< 1.6.1-3+deb9u3","noFixRecorded":false,"fixedIn":null},{"text":"< 1.3.0-3+deb8u3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.0-3 | < 1.6.1-3+deb9u3 | < 1.3.0-3+deb8u3","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"libvpx","name":"libvpx","label":"libvpx","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/libvpx","purlType":"deb","versions":[{"text":"< 1.3.0-2ubuntu0.1~esm2","noFixRecorded":false,"fixedIn":null},{"text":"< 1.5.0-2ubuntu1.1+esm1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.0-2ubuntu0.1~esm2 | < 1.5.0-2ubuntu1.1+esm1","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"9.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"9.0","eol":{"isEol":true,"eolDate":"2022-07-01T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"9","label":"9 (Stretch)","eolFrom":"2022-07-01T00:00:00.000Z","isLts":false,"isMaintained":true,"latestVersion":"9.13"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"google","product":"android","name":"android","label":"android","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"8.0","noFixRecorded":false,"fixedIn":null},{"text":"8.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.0 | 8.1","eol":{"isEol":true,"eolDate":"2021-01-01T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"8.0","label":"8.0 'Oreo'","eolFrom":"2021-01-01T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"android","label":"Android OS","category":"os"}},"hubHref":"/vendor/google/android"},{"vendor":"opensuse","product":"libvpx&distro=openSUSE Leap 15.1","name":"libvpx","label":"libvpx&distro=openSUSE Leap 15.1","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/libvpx&distro=openSUSE Leap 15.1","purlType":"rpm","versions":[{"text":"< 1.6.1-lp151.5.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.1-lp151.5.6.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"libvpx&distro=openSUSE Tumbleweed","name":"libvpx","label":"libvpx&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/libvpx&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 1.11.0-3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.11.0-3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"libvpx&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","name":"libvpx","label":"libvpx&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libvpx&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","purlType":"rpm","versions":[{"text":"< 1.6.1-6.6.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.1-6.6.8","eol":null,"hubHref":null},{"vendor":"suse","product":"libvpx&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2","name":"libvpx","label":"libvpx&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libvpx&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2","purlType":"rpm","versions":[{"text":"< 1.6.1-6.6.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.1-6.6.8","eol":null,"hubHref":null},{"vendor":"suse","product":"libvpx&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1","name":"libvpx","label":"libvpx&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libvpx&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1","purlType":"rpm","versions":[{"text":"< 1.6.1-6.6.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.1-6.6.8","eol":null,"hubHref":null},{"vendor":"suse","product":"libvpx&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP2","name":"libvpx","label":"libvpx&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libvpx&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP2","purlType":"rpm","versions":[{"text":"< 1.6.1-6.6.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.1-6.6.8","eol":null,"hubHref":null},{"vendor":"suse","product":"libvpx&distro=SUSE Linux Enterprise Module for Package Hub 15 SP1","name":"libvpx","label":"libvpx&distro=SUSE Linux Enterprise Module for Package Hub 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libvpx&distro=SUSE Linux Enterprise Module for Package Hub 15 SP1","purlType":"rpm","versions":[{"text":"< 1.6.1-6.6.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.1-6.6.8","eol":null,"hubHref":null},{"vendor":"suse","product":"libvpx&distro=SUSE Linux Enterprise Module for Package Hub 15 SP2","name":"libvpx","label":"libvpx&distro=SUSE Linux Enterprise Module for Package Hub 15 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libvpx&distro=SUSE Linux Enterprise Module for Package Hub 15 SP2","purlType":"rpm","versions":[{"text":"< 1.6.1-6.6.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.1-6.6.8","eol":null,"hubHref":null},{"vendor":"suse","product":"libvpx&distro=SUSE Linux Enterprise Server 12 SP5","name":"libvpx","label":"libvpx&distro=SUSE Linux Enterprise Server 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libvpx&distro=SUSE Linux Enterprise Server 12 SP5","purlType":"rpm","versions":[{"text":"< 1.3.0-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.0-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"libvpx&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","name":"libvpx","label":"libvpx&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libvpx&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","purlType":"rpm","versions":[{"text":"< 1.3.0-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.0-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"libvpx&distro=SUSE Linux Enterprise Software Development Kit 12 SP5","name":"libvpx","label":"libvpx&distro=SUSE Linux Enterprise Software Development Kit 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libvpx&distro=SUSE Linux Enterprise Software Development Kit 12 SP5","purlType":"rpm","versions":[{"text":"< 1.3.0-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.0-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"libvpx&distro=SUSE Linux Enterprise Workstation Extension 12 SP5","name":"libvpx","label":"libvpx&distro=SUSE Linux Enterprise Workstation Extension 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libvpx&distro=SUSE Linux Enterprise Workstation Extension 12 SP5","purlType":"rpm","versions":[{"text":"< 1.3.0-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.0-3.9.1","eol":null,"hubHref":null}],"affectedCount":17,"eol":{"hasEol":true,"count":2},"references":[{"url":"https://source.android.com/security/bulletin/2020-03-01","label":"source.android.com/security/bulletin/2020-03-01","hostname":"source.android.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00048.html","label":"lists.opensuse.org/opensuse-security-announce/2020-05/msg00048.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/11/msg00024.html","label":"lists.debian.org/debian-lts-announce/2021/11/msg00024.html","hostname":"lists.debian.org","tags":["Mailing List","X Refsource MLIST","Third Party Advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-0034","label":"security.alpinelinux.org/vuln/CVE-2020-0034","hostname":"security.alpinelinux.org","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201297-1/","label":"www.suse.com/support/update/announcement/2020/suse-su-20201297-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1166066","label":"bugzilla.suse.com/1166066","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2020-0034","label":"www.suse.com/security/cve/CVE-2020-0034","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201297-2/","label":"www.suse.com/support/update/announcement/2020/suse-su-20201297-2/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20214168-1/","label":"www.suse.com/support/update/announcement/2021/suse-su-20214168-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-0034","label":"ubuntu.com/security/CVE-2020-0034","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-5637-1","label":"ubuntu.com/security/notices/USN-5637-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-0034","label":"www.cve.org/CVERecord?id=CVE-2020-0034","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-0034","label":"security-tracker.debian.org/tracker/CVE-2020-0034","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TCLO6H4TMYC4OPEGZQNYZIQBWIOHFIVS/","label":"lists.opensuse.org/archives/…","hostname":"lists.opensuse.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["RHSA-2020:3876"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-03-10T19:56:04.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T05:47:40.786Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T04:37:40.398Z","stale":false,"partial":false}}