CVE-2012-0823

Name	CVE-2012-0823
Description	VP8 Codec SDK (libvpx) before 1.0.0 "Duclair" allows remote attackers to cause a denial of service (application crash) via (1) unspecified "corrupt input" or (2) by "starting decoding from a P-frame," which triggers an out-of-bounds read, related to "the clamping of motion vectors in SPLITMV blocks".
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libvpx (PTS)	bullseye (security), bullseye	1.9.0-1+deb11u3	fixed
	bookworm, bookworm (security)	1.12.0-1+deb12u3	fixed
	sid, trixie	1.15.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libvpx	source	squeeze	(not affected)
libvpx	source	(unstable)	1.0.0-1

[squeeze] - libvpx <not-affected> (Introduced in 0.9.7)
http://blog.webmproject.org/2012/01/vp8-codec-sdk-duclair-released.html