CVE-2024-1580

Опубликовано: 19 фев. 2024

Источник: nvd

CVSS3: 5.9

CVSS3: 8.8

EPSS Низкий

Описание

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.

Ссылки

http://seclists.org/fulldisclosure/2024/Mar/36
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/37
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/38
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/39
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/40
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/41
Mailing List
https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS
Release Notes
https://code.videolan.org/videolan/dav1d/-/releases/1.4.0
Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/
Mailing List
https://support.apple.com/kb/HT214093
Third Party Advisory
https://support.apple.com/kb/HT214094
Third Party Advisory
https://support.apple.com/kb/HT214095
Third Party Advisory
https://support.apple.com/kb/HT214096
Third Party Advisory
https://support.apple.com/kb/HT214097
Third Party Advisory
https://support.apple.com/kb/HT214098
Third Party Advisory
http://seclists.org/fulldisclosure/2024/Mar/36
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/37
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/38
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/39
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/40
Mailing List

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:videolan:dav1d:*:*:*:*:*:*:*:*

Версия до 1.4.0 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

Версия до 17.4.1 (исключая)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Версия до 16.7.7 (исключая)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Версия от 17.0 (включая) до 17.4.1 (исключая)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия до 16.7.7 (исключая)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия от 17.0 (включая) до 17.4.1 (исключая)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия от 13.0 (включая) до 13.6.6 (исключая)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия от 14.0 (включая) до 14.4.1 (исключая)

cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*

Версия до 1.1.1 (исключая)

Конфигурация 3

cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

EPSS

Процентиль: 77%

0.01835

Низкий

5.9 Medium

CVSS3

8.8 High

CVSS3

Дефекты

CWE-190

Связанные уязвимости

CVE-2024-1580

CVSS3: 5.9

ubuntu

больше 2 лет назад

CVE-2024-1580

msrc

6 месяцев назад

Integer overflow in VideoLAN dav1d

CVE-2024-1580

CVSS3: 5.9

debian

больше 2 лет назад

An integer overflow in dav1d AV1 decoder that can occur when decoding ...

SUSE-SU-2024:0964-1

suse-cvrf

больше 2 лет назад

Security update for dav1d

SUSE-SU-2024:0963-1

suse-cvrf

больше 2 лет назад

Security update for dav1d

EPSS

Процентиль: 77%

0.01835

Низкий

5.9 Medium

CVSS3

8.8 High

CVSS3

Дефекты

CWE-190