CVE-2024-1580

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1580
An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 4.7

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
http://seclists.org/fulldisclosure/2024/Mar/36 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/37 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/38 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/39 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/40 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/41 Mailing List
https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS Release Notes
https://code.videolan.org/videolan/dav1d/-/releases/1.4.0 Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/ Mailing List
https://support.apple.com/kb/HT214093 Third Party Advisory
https://support.apple.com/kb/HT214094 Third Party Advisory
https://support.apple.com/kb/HT214095 Third Party Advisory
https://support.apple.com/kb/HT214096 Third Party Advisory
https://support.apple.com/kb/HT214097 Third Party Advisory
https://support.apple.com/kb/HT214098 Third Party Advisory
http://seclists.org/fulldisclosure/2024/Mar/36 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/37 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/38 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/39 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/40 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/41 Mailing List
https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS Release Notes
https://code.videolan.org/videolan/dav1d/-/releases/1.4.0 Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/ Mailing List
https://support.apple.com/kb/HT214093 Third Party Advisory
https://support.apple.com/kb/HT214094 Third Party Advisory
https://support.apple.com/kb/HT214095 Third Party Advisory
https://support.apple.com/kb/HT214096 Third Party Advisory
https://support.apple.com/kb/HT214097 Third Party Advisory
https://support.apple.com/kb/HT214098 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:videolan:dav1d:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
History

13 Feb 2025, 18:16

Type Values Removed Values Added
Summary (en) An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d. (en) An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.

23 Jan 2025, 16:48

Type Values Removed Values Added
References () http://seclists.org/fulldisclosure/2024/Mar/36 - () http://seclists.org/fulldisclosure/2024/Mar/36 - Mailing List
References () http://seclists.org/fulldisclosure/2024/Mar/37 - () http://seclists.org/fulldisclosure/2024/Mar/37 - Mailing List
References () http://seclists.org/fulldisclosure/2024/Mar/38 - () http://seclists.org/fulldisclosure/2024/Mar/38 - Mailing List
References () http://seclists.org/fulldisclosure/2024/Mar/39 - () http://seclists.org/fulldisclosure/2024/Mar/39 - Mailing List
References () http://seclists.org/fulldisclosure/2024/Mar/40 - () http://seclists.org/fulldisclosure/2024/Mar/40 - Mailing List
References () http://seclists.org/fulldisclosure/2024/Mar/41 - () http://seclists.org/fulldisclosure/2024/Mar/41 - Mailing List
References () https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS - () https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS - Release Notes
References () https://code.videolan.org/videolan/dav1d/-/releases/1.4.0 - () https://code.videolan.org/videolan/dav1d/-/releases/1.4.0 - Release Notes
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/ - Mailing List
References () https://support.apple.com/kb/HT214093 - () https://support.apple.com/kb/HT214093 - Third Party Advisory
References () https://support.apple.com/kb/HT214094 - () https://support.apple.com/kb/HT214094 - Third Party Advisory
References () https://support.apple.com/kb/HT214095 - () https://support.apple.com/kb/HT214095 - Third Party Advisory
References () https://support.apple.com/kb/HT214096 - () https://support.apple.com/kb/HT214096 - Third Party Advisory
References () https://support.apple.com/kb/HT214097 - () https://support.apple.com/kb/HT214097 - Third Party Advisory
References () https://support.apple.com/kb/HT214098 - () https://support.apple.com/kb/HT214098 - Third Party Advisory
First Time Apple visionos
Videolan
Videolan dav1d
Apple safari
Apple
Fedoraproject fedora
Fedoraproject
Apple ipados
Apple iphone Os
Apple macos
CPE cpe:2.3:a:videolan:dav1d:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

21 Nov 2024, 08:50

Type Values Removed Values Added
References () http://seclists.org/fulldisclosure/2024/Mar/36 - () http://seclists.org/fulldisclosure/2024/Mar/36 -
References () http://seclists.org/fulldisclosure/2024/Mar/37 - () http://seclists.org/fulldisclosure/2024/Mar/37 -
References () http://seclists.org/fulldisclosure/2024/Mar/38 - () http://seclists.org/fulldisclosure/2024/Mar/38 -
References () http://seclists.org/fulldisclosure/2024/Mar/39 - () http://seclists.org/fulldisclosure/2024/Mar/39 -
References () http://seclists.org/fulldisclosure/2024/Mar/40 - () http://seclists.org/fulldisclosure/2024/Mar/40 -
References () http://seclists.org/fulldisclosure/2024/Mar/41 - () http://seclists.org/fulldisclosure/2024/Mar/41 -
References () https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS - () https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS -
References () https://code.videolan.org/videolan/dav1d/-/releases/1.4.0 - () https://code.videolan.org/videolan/dav1d/-/releases/1.4.0 -
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/ -
References () https://support.apple.com/kb/HT214093 - () https://support.apple.com/kb/HT214093 -
References () https://support.apple.com/kb/HT214094 - () https://support.apple.com/kb/HT214094 -
References () https://support.apple.com/kb/HT214095 - () https://support.apple.com/kb/HT214095 -
References () https://support.apple.com/kb/HT214096 - () https://support.apple.com/kb/HT214096 -
References () https://support.apple.com/kb/HT214097 - () https://support.apple.com/kb/HT214097 -
References () https://support.apple.com/kb/HT214098 - () https://support.apple.com/kb/HT214098 -

27 Mar 2024, 18:15

Type Values Removed Values Added
References
  • () http://seclists.org/fulldisclosure/2024/Mar/41 -
  • () http://seclists.org/fulldisclosure/2024/Mar/38 -
  • () http://seclists.org/fulldisclosure/2024/Mar/37 -
  • () http://seclists.org/fulldisclosure/2024/Mar/36 -
  • () http://seclists.org/fulldisclosure/2024/Mar/39 -
  • () http://seclists.org/fulldisclosure/2024/Mar/40 -

26 Mar 2024, 00:15

Type Values Removed Values Added
References
  • () https://support.apple.com/kb/HT214094 -

25 Mar 2024, 18:15

Type Values Removed Values Added
References
  • () https://support.apple.com/kb/HT214096 -
  • () https://support.apple.com/kb/HT214093 -
  • () https://support.apple.com/kb/HT214095 -
  • () https://support.apple.com/kb/HT214097 -
  • () https://support.apple.com/kb/HT214098 -

23 Mar 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/ -

19 Feb 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-19 11:15

Updated : 2025-02-13 18:16

NVD link : CVE-2024-1580

Mitre link : CVE-2024-1580

CVE.ORG link : CVE-2024-1580

JSON object : View

Products Affected

fedoraproject

  • fedora

apple

  • iphone_os
  • visionos
  • ipados
  • safari
  • macos

videolan

  • dav1d
CWE
CWE-190

Integer Overflow or Wraparound