CVE-2024-1580
published 2024-02-19CVE-2024-1580: An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder…
PriorityP352high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.84%
76.7th percentile
An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_16.7.7_and_ipados | — | — |
| apple | ios_17.4.1_and_ipados | — | — |
| apple | ipados | < 16.7.7 | 16.7.7 |
| apple | ipados | >= 17.0 < 17.4.1 | 17.4.1 |
| apple | iphone_os | < 16.7.7 | 16.7.7 |
| apple | iphone_os | >= 17.0 < 17.4.1 | 17.4.1 |
| apple | macos | >= 13.0 < 13.6.6 | 13.6.6 |
| apple | macos | >= 14.0 < 14.4.1 | 14.4.1 |
| apple | macos_sonoma | — | — |
| apple | macos_ventura | — | — |
| apple | safari | < 17.4.1 | 17.4.1 |
| apple | safari | — | — |
| apple | visionos | < 1.1.1 | 1.1.1 |
| apple | visionos | — | — |
| debian | dav1d | < dav1d 1.0.0-2+deb12u1 (bookworm) | dav1d 1.0.0-2+deb12u1 (bookworm) |
| fedoraproject | fedora | — | — |
| videolan | dav1d | < 1.4.0 | 1.4.0 |
| videolan | dav1d | >= 0 < 0.7.1-3+deb11u1 | 0.7.1-3+deb11u1 |
| videolan | dav1d | >= 0 < 1.0.0-2+deb12u1 | 1.0.0-2+deb12u1 |
| videolan | dav1d | >= 0 < 1.4.0-1 | 1.4.0-1 |
| videolan | dav1d | >= 0 < 1.4.0-1 | 1.4.0-1 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Project0
Effective Fuzzing: A Dav1d Case Study - Project Zero
project_zero·2024-10-01·CVSS 5.9
CVE-2024-1580 [MEDIUM] Effective Fuzzing: A Dav1d Case Study - Project Zero
Guest post by Nick Galloway, Senior Security Engineer, 20% time on Project Zero
Late in 2023, while working on a 20% project with Project Zero, I found an integer overflow in the dav1d AV1 video decoder. That integer overflow leads to an out-of-bounds write to memory. Dav1d 1.4.0 patched this, and it was assigned CVE-2024-1580. After the disclosure, I received some questions about how this issue was discovered, since dav1d is already being fuzzed by at least oss-fuzz. This blog post explains what happened. It’s a useful case study in how to construct fuzzers to exercise as much code as possible. But first, some background...Background
## Dav1d
Dav1d is a highly-optimized AV1 decoder. AV1 is a royalty-free video coding format developed by the Alliance for Open Media, and achieves imp
GHSA
GHSA-3p7f-4r2q-wxmm: An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size
ghsa_unreviewed·2024-02-19
CVE-2024-1580 [MEDIUM] CWE-190 GHSA-3p7f-4r2q-wxmm: An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size
An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.
OSV
CVE-2024-1580: An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size
osv·2024-02-19·CVSS 8.8
CVE-2024-1580 [HIGH] CVE-2024-1580: An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size
An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.
Apple
CVE-2024-1580: macOS Sonoma 14.4.1
vendor_apple·2024-03-25·CVSS 5.9
CVE-2024-1580 [MEDIUM] CVE-2024-1580: macOS Sonoma 14.4.1
Apple Security Update: About the security content of macOS Sonoma 14.4.1
Product: macOS Sonoma
Version: 14.4.1
CVE: CVE-2024-1580
Component: CoreMedia
Impact: Processing an image may lead to arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved input validation.
Apple
CVE-2024-1580: Safari 17.4.1
vendor_apple·2024-03-25·CVSS 5.9
CVE-2024-1580 [MEDIUM] CVE-2024-1580: Safari 17.4.1
Apple Security Update: About the security content of Safari 17.4.1
Product: Safari
Version: 17.4.1
CVE: CVE-2024-1580
Component: WebRTC
Impact: Processing an image may lead to arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved input validation.
Apple
CVE-2024-1580: macOS Ventura 13.6.6
vendor_apple·2024-03-25·CVSS 5.9
CVE-2024-1580 [MEDIUM] CVE-2024-1580: macOS Ventura 13.6.6
Apple Security Update: About the security content of macOS Ventura 13.6.6
Product: macOS Ventura
Version: 13.6.6
CVE: CVE-2024-1580
Component: CoreMedia
Impact: Processing an image may lead to arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved input validation.
Apple
CVE-2024-1580: iOS 17.4.1 and iPadOS 17.4.1
vendor_apple·2024-03-21·CVSS 5.9
CVE-2024-1580 [MEDIUM] CVE-2024-1580: iOS 17.4.1 and iPadOS 17.4.1
Apple Security Update: About the security content of iOS 17.4.1 and iPadOS 17.4.1
Product: iOS 17.4.1 and iPadOS
Version: 17.4.1
CVE: CVE-2024-1580
Component: CoreMedia
Impact: Processing an image may lead to arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved input validation.
Apple
CVE-2024-1580: visionOS 1.1.1
vendor_apple·2024-03-21·CVSS 5.9
CVE-2024-1580 [MEDIUM] CVE-2024-1580: visionOS 1.1.1
Apple Security Update: About the security content of visionOS 1.1.1
Product: visionOS
Version: 1.1.1
CVE: CVE-2024-1580
Component: CoreMedia
Impact: Processing an image may lead to arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved input validation.
Apple
CVE-2024-1580: iOS 16.7.7 and iPadOS 16.7.7
vendor_apple·2024-03-21·CVSS 5.9
CVE-2024-1580 [MEDIUM] CVE-2024-1580: iOS 16.7.7 and iPadOS 16.7.7
Apple Security Update: About the security content of iOS 16.7.7 and iPadOS 16.7.7
Product: iOS 16.7.7 and iPadOS
Version: 16.7.7
CVE: CVE-2024-1580
Component: CoreMedia
Impact: Processing an image may lead to arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved input validation.
Debian
CVE-2024-1580: dav1d - An integer overflow in dav1d AV1 decoder that can occur when decoding videos wit...
vendor_debian·2024·CVSS 5.9
CVE-2024-1580 [MEDIUM] CVE-2024-1580: dav1d - An integer overflow in dav1d AV1 decoder that can occur when decoding videos wit...
An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.
Scope: local
bookworm: resolved (fixed in 1.0.0-2+deb12u1)
bullseye: resolved (fixed in 0.7.1-3+deb11u1)
forky: resolved (fixed in 1.4.0-1)
sid: resolved (fixed in 1.4.0-1)
trixie: resolved (fixed in 1.4.0-1)
No detection rules found.
No public exploits indexed.
http://seclists.org/fulldisclosure/2024/Mar/36http://seclists.org/fulldisclosure/2024/Mar/37http://seclists.org/fulldisclosure/2024/Mar/38http://seclists.org/fulldisclosure/2024/Mar/39http://seclists.org/fulldisclosure/2024/Mar/40http://seclists.org/fulldisclosure/2024/Mar/41https://code.videolan.org/videolan/dav1d/-/blob/master/NEWShttps://code.videolan.org/videolan/dav1d/-/releases/1.4.0https://lists.fedoraproject.org/archives/list/[email protected]/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/https://support.apple.com/kb/HT214093https://support.apple.com/kb/HT214094https://support.apple.com/kb/HT214095https://support.apple.com/kb/HT214096https://support.apple.com/kb/HT214097https://support.apple.com/kb/HT214098http://seclists.org/fulldisclosure/2024/Mar/36http://seclists.org/fulldisclosure/2024/Mar/37http://seclists.org/fulldisclosure/2024/Mar/38http://seclists.org/fulldisclosure/2024/Mar/39http://seclists.org/fulldisclosure/2024/Mar/40http://seclists.org/fulldisclosure/2024/Mar/41https://code.videolan.org/videolan/dav1d/-/blob/master/NEWShttps://code.videolan.org/videolan/dav1d/-/releases/1.4.0https://lists.fedoraproject.org/archives/list/[email protected]/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/https://support.apple.com/kb/HT214093https://support.apple.com/kb/HT214094https://support.apple.com/kb/HT214095https://support.apple.com/kb/HT214096https://support.apple.com/kb/HT214097https://support.apple.com/kb/HT214098
2024-02-19
Published