CVE-2024-1580
Assigner: Google
Published: 2024-02-19T10:34:55.113Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: dav1d
repo: https://code.videolan.org/videolan/dav1d
vendor: VideoLAN
versions: lessThan: 1.4.0
status: affected
version: 0
versionType: custom
datePublic: 2024-02-15T11:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <p>An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.</p><br><br>
value: An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.




impacts: capecId: CAPEC-100
descriptions: value: CAPEC-100 Overflow Buffers
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-190
description: CWE-190 Integer Overflow or Wraparound
type: CWE
source: discovery: UNKNOWN
title: Integer overflow in VideoLAN dav1d
x_generator: engine: Vulnogram 0.1.0-dev