16 results · Feed
-
High 7.1
Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id
A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of lay…
-
High 7.1
Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames
A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that ov…
-
High 7.1
Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack
An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh…
-
High 7.6
Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode
A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set…
-
Critical 10.0
heap buffer overflow in libaom
Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers: * Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the…
-
Critical 9.0
heap buffer overflow in libaom
Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc().
-
Unscored —
AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_…
-
Unscored —
AOM v2.0.1 was discovered to contain a global buffer overflow via the component av1/encoder/partition_search.h.
-
Unscored —
AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.
-
Unscored —
AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.
-
Unscored —
AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.
-
Unscored —
AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.
-
Unscored —
aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow.
-
Unscored —
aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
-
Unscored —
aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.
-
Unscored —
In extend_frame_lowbd of restoration.c, there is a possible out of bounds write due to a missing bounds check. This cou…