CVE-2024-1580

Sažetak

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.

Reference

http://seclists.org/fulldisclosure/2024/Mar/36
http://seclists.org/fulldisclosure/2024/Mar/37
http://seclists.org/fulldisclosure/2024/Mar/38
http://seclists.org/fulldisclosure/2024/Mar/39
http://seclists.org/fulldisclosure/2024/Mar/40
http://seclists.org/fulldisclosure/2024/Mar/41
https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS
https://code.videolan.org/videolan/dav1d/-/releases/1.4.0
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/
https://support.apple.com/kb/HT214093
https://support.apple.com/kb/HT214094
https://support.apple.com/kb/HT214095
https://support.apple.com/kb/HT214096
https://support.apple.com/kb/HT214097
https://support.apple.com/kb/HT214098
http://seclists.org/fulldisclosure/2024/Mar/36
http://seclists.org/fulldisclosure/2024/Mar/37
http://seclists.org/fulldisclosure/2024/Mar/38
http://seclists.org/fulldisclosure/2024/Mar/39
http://seclists.org/fulldisclosure/2024/Mar/40
http://seclists.org/fulldisclosure/2024/Mar/41
https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS
https://code.videolan.org/videolan/dav1d/-/releases/1.4.0
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/
https://support.apple.com/kb/HT214093
https://support.apple.com/kb/HT214094
https://support.apple.com/kb/HT214095
https://support.apple.com/kb/HT214096
https://support.apple.com/kb/HT214097
https://support.apple.com/kb/HT214098

CVSS

Base:	5.9
Impact:	4.7
Exploitability:	1.2

Pristup

Vektor	Složenost	Autentikacija
ADJACENT_NETWORK	HIGH	LOW

Impact

Povjerljivost	Cjelovitost	Dostupnost
LOW	HIGH	LOW

CVSS vektor

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Zadnje važnije ažuriranje

13-02-2025 - 18:16

Objavljeno

19-02-2024 - 11:15