CVE-2023-6879: 
Linux Debian vulnerability analysis and mitigation

CVE-2023-6879 is a heap overflow vulnerability discovered in the AOM (Alliance for Open Media) codec library. The vulnerability occurs when increasing the resolution of video frames while performing a multi-threaded encode, which can result in a heap overflow in the av1_loop_restoration_dealloc() function (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) by NIST with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, while Google Inc. assessed it with a score of 9.0 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. The vulnerability is classified as CWE-787 (Out-of-bounds Write) by NIST and CWE-20 (Improper Input Validation) by Google Inc (NVD).

The vulnerability affects the AOM codec library versions up to (excluding) 3.7.1. When successfully exploited, this heap overflow vulnerability could potentially lead to code execution, system crashes, or other forms of memory corruption (NVD).

The vulnerability has been fixed in AOM version 3.7.1. Users and system administrators are advised to upgrade to this version or later. The fix has also been incorporated into various downstream products, including Fedora 38 and 39 through security updates (Fedora 38 Update, Fedora 39 Update).