CVE-2023-22656

NameCVE-2023-22656
DescriptionOut-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1082866, 1082867

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
intel-mediasdk (PTS)bullseye21.1.0-1vulnerable
sid, trixie, bookworm22.5.4-1vulnerable
onevpl (PTS)bookworm2023.1.1-1vulnerable
sid, trixie1:2.13.0-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
intel-mediasdksource(unstable)(unfixed)1082866
onevplsource(unstable)(unfixed)1082867

Notes

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00935.html

Search for package or bug name: Reporting problems