CVE-2023-32570

2023-05-1005:15:12

Debian Security Bug Tracker

security-tracker.debian.org

videolan

dav1d

1.2.0

thread_task.c

race condition

application crash

unix

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

57.3%

JSON

VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.

OSVersionArchitecturePackageVersionFilename
Debian12alldav1d<= 1.0.0-2+deb12u1dav1d_1.0.0-2+deb12u1_all.deb
Debian11alldav1d<= 0.7.1-3+deb11u1dav1d_0.7.1-3+deb11u1_all.deb
Debian999alldav1d< 1.2.1-2dav1d_1.2.1-2_all.deb
Debian13alldav1d< 1.2.1-2dav1d_1.2.1-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	dav1d	<= 1.0.0-2+deb12u1	dav1d_1.0.0-2+deb12u1_all.deb
Debian	11	all	dav1d	<= 0.7.1-3+deb11u1	dav1d_0.7.1-3+deb11u1_all.deb
Debian	999	all	dav1d	< 1.2.1-2	dav1d_1.2.1-2_all.deb
Debian	13	all	dav1d	< 1.2.1-2	dav1d_1.2.1-2_all.deb