CVE-2024-1580

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1580
An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://seclists.org/fulldisclosure/2024/Mar/36 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/36 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/37 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/37 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/38 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/38 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/39 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/39 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/40 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/40 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/41 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/41 Mailing List
https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS Release Notes
https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS Release Notes
https://code.videolan.org/videolan/dav1d/-/releases/1.4.0 Release Notes
https://code.videolan.org/videolan/dav1d/-/releases/1.4.0 Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/ Mailing List
https://support.apple.com/kb/HT214093 Third Party Advisory
https://support.apple.com/kb/HT214093 Third Party Advisory
https://support.apple.com/kb/HT214094 Third Party Advisory
https://support.apple.com/kb/HT214094 Third Party Advisory
https://support.apple.com/kb/HT214095 Third Party Advisory
https://support.apple.com/kb/HT214095 Third Party Advisory
https://support.apple.com/kb/HT214096 Third Party Advisory
https://support.apple.com/kb/HT214096 Third Party Advisory
https://support.apple.com/kb/HT214097 Third Party Advisory
https://support.apple.com/kb/HT214097 Third Party Advisory
https://support.apple.com/kb/HT214098 Third Party Advisory
https://support.apple.com/kb/HT214098 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:videolan:dav1d:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
History

13 Feb 2025, 18:16

Type Values Removed Values Added
Summary An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d. An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.

23 Jan 2025, 16:48

Type Values Removed Values Added
CPE cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
cpe:2.3:a:videolan:dav1d:*:*:*:*:*:*:*:*
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
References () http://seclists.org/fulldisclosure/2024/Mar/38 - () http://seclists.org/fulldisclosure/2024/Mar/38 - Mailing List
References () https://support.apple.com/kb/HT214095 - () https://support.apple.com/kb/HT214095 - Third Party Advisory
References () http://seclists.org/fulldisclosure/2024/Mar/36 - () http://seclists.org/fulldisclosure/2024/Mar/36 - Mailing List
References () https://support.apple.com/kb/HT214094 - () https://support.apple.com/kb/HT214094 - Third Party Advisory
References () https://support.apple.com/kb/HT214096 - () https://support.apple.com/kb/HT214096 - Third Party Advisory
References () http://seclists.org/fulldisclosure/2024/Mar/40 - () http://seclists.org/fulldisclosure/2024/Mar/40 - Mailing List
References () https://support.apple.com/kb/HT214093 - () https://support.apple.com/kb/HT214093 - Third Party Advisory
References () http://seclists.org/fulldisclosure/2024/Mar/41 - () http://seclists.org/fulldisclosure/2024/Mar/41 - Mailing List
References () http://seclists.org/fulldisclosure/2024/Mar/37 - () http://seclists.org/fulldisclosure/2024/Mar/37 - Mailing List
References () http://seclists.org/fulldisclosure/2024/Mar/39 - () http://seclists.org/fulldisclosure/2024/Mar/39 - Mailing List
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/ - Mailing List
References () https://support.apple.com/kb/HT214098 - () https://support.apple.com/kb/HT214098 - Third Party Advisory
References () https://code.videolan.org/videolan/dav1d/-/releases/1.4.0 - () https://code.videolan.org/videolan/dav1d/-/releases/1.4.0 - Release Notes
References () https://support.apple.com/kb/HT214097 - () https://support.apple.com/kb/HT214097 - Third Party Advisory
References () https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS - () https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS - Release Notes
First Time Apple ipados
Videolan dav1d
Fedoraproject
Apple macos
Apple
Fedoraproject fedora
Apple visionos
Apple safari
Videolan
Apple iphone Os
CWE CWE-190

27 Mar 2024, 18:15

Type Values Removed Values Added
References
  • () http://seclists.org/fulldisclosure/2024/Mar/36 -
  • () http://seclists.org/fulldisclosure/2024/Mar/38 -
  • () http://seclists.org/fulldisclosure/2024/Mar/37 -
  • () http://seclists.org/fulldisclosure/2024/Mar/41 -
  • () http://seclists.org/fulldisclosure/2024/Mar/39 -
  • () http://seclists.org/fulldisclosure/2024/Mar/40 -

26 Mar 2024, 00:15

Type Values Removed Values Added
References
  • () https://support.apple.com/kb/HT214094 -

25 Mar 2024, 18:15

Type Values Removed Values Added
References
  • () https://support.apple.com/kb/HT214098 -
  • () https://support.apple.com/kb/HT214097 -
  • () https://support.apple.com/kb/HT214093 -
  • () https://support.apple.com/kb/HT214096 -
  • () https://support.apple.com/kb/HT214095 -

23 Mar 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/ -

19 Feb 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-19 11:15

Updated : 2025-02-13 18:16

NVD link : CVE-2024-1580

Mitre link : CVE-2024-1580

JSON object : View

Products Affected

fedoraproject

  • fedora

apple

  • ipados
  • safari
  • macos
  • visionos
  • iphone_os

videolan

  • dav1d
CWE
CWE-190

Integer Overflow or Wraparound