libdav1d-sys affected by dav1d AV1 decoder integer overflow

2024-04-0515:42:39

CWE-190

GitHub Advisory Database

github.com

libdav1d-sys

dav1d av1 decoder

integer overflow

memory corruption

upgrade

AI Score

7.6

Confidence

High

JSON

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading to version 0.7.0 of libdav1d-sys, which includes dav1d 1.4.0.

Affected configurations

Vulners

Node

libdav1d-sysRange<0.7.0

VendorProductVersionCPE
*libdav1d-sys*cpe:2.3:a:*:libdav1d-sys:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
*	libdav1d-sys	*	cpe:2.3:a::libdav1d-sys::::::::*

References

github.com/advisories/GHSA-mc39-h54g-pvw6

rustsec.org/advisories/RUSTSEC-2024-0016.html

www.cvedetails.com/cve/CVE-2024-1580

AI Score

7.6

Confidence

High

JSON