CVE-2023-44488: debian debian_linux
CVSS: 7.5v3.1HighModified
AliasesMGASA-2023-0338RHSA-2023:6190RHSA-2023:6192UBUNTU-CVE-2023-44488DEBIAN-CVE-2023-44488DSA-5518-1
Published 30-09-2023Last modified 23-09-2024
Vulnerability summary
CVE-2023-44488 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 2.16% chance of exploitation in the next 30 days, higher than 81.9% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
2.16%
0%100%
Low · +0.22 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 25 · Related 4DLA-3598-1RHSA-2023:5534RHSA-2023:5535RHSA-2023:5536RHSA-2023:5537RHSA-2023:5538RHSA-2023:5539RHSA-2023:5540RHSA-2023:6162RHSA-2023:6185RHSA-2023:6186RHSA-2023:6187RHSA-2023:6188RHSA-2023:6189RHSA-2023:6191RHSA-2023:6194RHSA-2023:6195RHSA-2023:6196RHSA-2023:6197RHSA-2023:6198RHSA-2023:6199SUSE-SU-2024:2409-1USN-6403-1USN-6403-2USN-6403-3
Timeline
- 30-09-2023PublishedVulnerability first disclosed.
- 23-09-2024Last modifiedVulnerability information updated.
Description
VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding.
CVSS metrics
4 scores · 4 sources · 1 versionHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.16%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
+0.22 pp
From 1.94% on 20-09-2026
20-09-202620-10-2026
EPSS score2.16%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu8 products
- firefox< 118.0.1+build1-0ubuntu0.20.04.1
- libvpxAll versions (No fix recorded) | < 1.5.0-2ubuntu1.1+esm2 | < 1.7.0-3ubuntu0.18.04.1+esm1 | < 1.8.2-1ubuntu0.2 | < 1.11.0-2ubuntu2.2 | < 1.12.0-1ubuntu2
- mozjs102All versions (No fix recorded)
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
Redhat7 products
- enterprise_linux8.0 | 9.0
- firefox< 0:115.4.0-1.el8_4
- firefox-debuginfo< 0:115.4.0-1.el8_4
- firefox-debugsource< 0:115.4.0-1.el8_4
- thunderbird< 0:115.4.1-1.el9_0
Debian2 products
- libvpx< 1.12.0-1.2 | < 1.9.0-1+deb11u2 | < 1.12.0-1+deb12u2
- debian_linuxEOL10.0 | 11.0 | 12.0
Fedoraproject1 product
- fedoraEOL37
Mageia1 product
- libvpx< 1.12.0-1.2.mga9
Webmproject1 product
- libvpx< 1.13.1
6 vendors · 20 products
References
26 links- github.com/webmproject/libvpx/releases/tag/v1.13.1Release Notes
