PT-2023-23880 · Videolan+3 · Dav1D+3

Victorien Le Couviour--Tuffet · Publicado 2023-05-09 · Atualizado 2025-08-12 · CVE-2023-32570

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions VideoLAN dav1d versions prior to 1.2.0

Description The issue is related to a thread task.c race condition that can lead to an application crash. This condition is associated with the dav1d decode frame exit function.

Recommendations For versions prior to 1.2.0, update to version 1.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the dav1d decode frame exit function until a patch is available.

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

ALT-PU-2023-1906

ALT-PU-2024-2955

ALT-PU-2024-4636

CVE-2023-32570

ECHO-CA6C-4314-8DC3

OPENSUSE-SU-2024:13730-1

ROSA-SA-2024-2376

SUSE-SU-2023:2618-1

SUSE-SU-2023_2618-1

Produtos afetados

Alt Linux

Debian

Suse

Dav1D

Referências · 21

• https://t.me/cibsecurity/63723 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-32570 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WGSO7UMOF4MVLQ5H6KIV7OG6ONS377B · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-32570 · Nota de Segurança
• https://docs.bell-sw.com/security/cves/CVE-2023-32570 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2023:2618-1 · Aviso do Fabricante
• https://t.me/cvenotify/50603 · Publicação no Telegram
• https://osv.dev/vulnerability/BELL-CVE-2023-32570 · Aviso do Fabricante
• https://code.videolan.org/videolan/dav1d/-/commit/cf617fdae0b9bfabd27282854c8e81450d955efa · Correção
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2023-32570 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LXZ6CUNJFDJLCFOZHY2TIGMCAEITLCRP · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2023-32570 · Nota
• https://code.videolan.org/videolan/dav1d/-/tags/1.2.0 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-32570 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-32570 · Aviso do Fabricante