libdav1d-sys affected by dav1d AV1 decoder integer overflow · GHSA-mc39-h54g-pvw6 · GitHub Advisory Database · GitHub

libdav1d-sys affected by dav1d AV1 decoder integer overflow

Moderate severity GitHub Reviewed Published Apr 5, 2024 to the GitHub Advisory Database • Updated Apr 5, 2024

Package

libdav1d-sys (Rust)

Affected versions

< 0.7.0

Patched versions

0.7.0

Description

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading to version 0.7.0 of libdav1d-sys, which includes dav1d 1.4.0.

References

Published to the GitHub Advisory Database Apr 5, 2024

Reviewed Apr 5, 2024

Last updated Apr 5, 2024

Severity

Moderate

5.9

/ 10

CVSS base metrics

Attack vector

Adjacent

Attack complexity

High

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L