1874258 - CVE-2023-6879 for bundled aom - firefox and thunderbird

Status: RESOLVED INVALID

(Core :: Audio/Video: Playback, defect)

Description

[yhang_wang]

CVE-2023-6879 is impacting aom. A back-porting or update may be required for aom. is there any plan to have it updated or patched?

https://nvd.nist.gov/vuln/detail/CVE-2023-6879

I rebuilt firefox/thunderbird with latest aom and all look good. the aom commit id I use is 7f3058e0c8b3c711f4173b23b888bda8d7acd952.

Comment 1

[yhang_wang]

btw, firefox/thunderbird version I rebuilt : 115..6.0.

Comment 2

[Daniel Veditz [:dveditz]]

I don't believe Firefox ESR 115 uses libaom (we use libdav1d), although an old copy is in the tree and there are still some left over prefs that let people turn off dav1d and fallback to libaom if they dig under the hood.

We are going to use the encoder for WebRTC, so we WONTFIXED the "get rid of the code" bug 1635296 and are hooking libaom up to our library update system in bug 1868615.

Comment 3

[yhang_wang]

thank you for the update and info. I'll keep watching;)

Comment 4

[Daniel Veditz [:dveditz]]

I was slightly wrong: the plan for the encoder was to use it for the Web Codecs spec, not WebRTC. But essentially the same -- we're not currently using this, and the bug that's referenced was in the decoder which we have no plan to use