CVE-2024-1580

Опубликовано: 19 фев. 2024

Источник: nvd

CVSS3: 5.9

CVSS3: 8.8

EPSS Низкий

Описание

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.

Ссылки

http://seclists.org/fulldisclosure/2024/Mar/36
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/37
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/38
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/39
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/40
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/41
Mailing List
https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS
Release Notes
https://code.videolan.org/videolan/dav1d/-/releases/1.4.0
Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/
Mailing List
https://support.apple.com/kb/HT214093
Third Party Advisory
https://support.apple.com/kb/HT214094
Third Party Advisory
https://support.apple.com/kb/HT214095
Third Party Advisory
https://support.apple.com/kb/HT214096
Third Party Advisory
https://support.apple.com/kb/HT214097
Third Party Advisory
https://support.apple.com/kb/HT214098
Third Party Advisory
http://seclists.org/fulldisclosure/2024/Mar/36
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/37
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/38
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/39
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/40
Mailing List

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:videolan:dav1d:*:*:*:*:*:*:*:*

Версия до 1.4.0 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

Версия до 17.4.1 (исключая)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Версия до 16.7.7 (исключая)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Версия от 17.0 (включая) до 17.4.1 (исключая)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия до 16.7.7 (исключая)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия от 17.0 (включая) до 17.4.1 (исключая)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия от 13.0 (включая) до 13.6.6 (исключая)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия от 14.0 (включая) до 14.4.1 (исключая)

cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*

Версия до 1.1.1 (исключая)

Конфигурация 3

cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

EPSS

Процентиль: 51%

0.00275

Низкий

5.9 Medium

CVSS3

8.8 High

CVSS3

Дефекты

CWE-190

Связанные уязвимости

CVE-2024-1580

CVSS3: 5.9

ubuntu

почти 2 года назад

CVE-2024-1580

CVSS3: 5.9

debian

почти 2 года назад

An integer overflow in dav1d AV1 decoder that can occur when decoding ...

SUSE-SU-2024:0964-1

suse-cvrf

почти 2 года назад

Security update for dav1d

SUSE-SU-2024:0963-1

suse-cvrf

почти 2 года назад

Security update for dav1d

GHSA-3p7f-4r2q-wxmm

CVSS3: 5.9

github

почти 2 года назад

EPSS

Процентиль: 51%

0.00275

Низкий

5.9 Medium

CVSS3

8.8 High

CVSS3

Дефекты

CWE-190