In una libreria libaom sviluppata dall'alleanza Open Media (AOMedia), che fornisce l'implementazione di riferimento del formato di codifica video AV1, \u00e8 stata identificata una vulnerabilit\u00e0 critica (CVE-2024-5171), che porta a un overflow intero e a una scrittura in un'area al di fuori dei limiti del buffer durante l'elaborazione di valori troppo grandi in alcuni parametri. Una vulnerabilit\u00e0 analoga (CVE-2024-5197) \u00e8 stata identificata nella libreria libvpx con l'implementazione dei codec VP8 e VP9. I problemi sono stati risolti negli aggiornamenti di libaom 3.9.0 e libvpx 1.14.1. Nelle distribuzioni, le vulnerabilit\u00e0 rimangono ancora non risolte (Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD). <\/p>\n
Alle vulnerabilit\u00e0 in libaom \u00e8 stato assegnato il livello massimo di pericolo (10 su 10), suggerendo la possibilit\u00e0 di sfruttamento durante l'elaborazione nelle applicazioni che utilizzano questa libreria, particolarmente con contenuti appositamente configurati. Per libvpx, il livello di pericolo \u00e8 stato fissato a 5.9 su 10, corrispondente a condizioni di sfruttamento limitate. Il principale rischio delle vulnerabilit\u00e0 in libaom e libvpx \u00e8 dovuto al fatto che queste librerie vengono utilizzate nei browser web, nei lettori multimediali e nei servizi che effettuano la ricodifica di video. <\/p>\n
La vulnerabilit\u00e0 si manifesta in libaom quando vengono chiamate le funzioni aom_img_alloc(), aom_img_wrap() o om_img_alloc_with_border() con grandi valori nei parametri d_w, d_h e align, che portano a un overflow intero nel calcolo degli offset e delle dimensioni dei buffer. Un overflow simile si verifica nelle funzioni vpx_img_alloc() e vpx_img_wrap(). Queste funzioni vengono utilizzate durante la codifica video. <\/p>\n
La vulnerabilit\u00e0 rappresenta il maggior rischio a causa della potenziale possibilit\u00e0 di attacco ai browser, dove vulnerabilit\u00e0 simili del passato potrebbero essere state sfruttate attraverso l'apertura in un browser di una pagina appositamente configurata che richiama funzioni JavaScript per la codifica video, o mediante manipolazioni con WebRTC. Secondo i rappresentanti di Google, la vulnerabilit\u00e0 non colpisce il motore Chromium, poich\u00e9 nelle funzioni aom_img_alloc(), aom_img_wrap(), vpx_img_alloc() e vpx_img_wrap() sono stati passati solo valori di argomento verificati per d_w e d_h. In Firefox, per la decodifica AV1 viene utilizzata la libreria dav1d, ma per la codifica viene utilizzata libaom. Non \u00e8 ancora chiaro se Firefox sia vulnerabile al problema, poich\u00e9 le informazioni su come la vulnerabilit\u00e0 influisca su prodotti specifici non sono ancora state pubblicate. \u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0430\u043b\u044c\u044f\u043d\u0441\u043e\u043c Open Media (AOMedia) \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libaom, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u0443\u044e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0444\u043e\u0440\u043c\u0430\u0442\u0430 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0438\u0434\u0435\u043e AV1, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-5171), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u044c \u0432\u043d\u0435 \u0433\u0440\u0430\u043d\u0438\u0446 \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u0431\u043e\u043b\u044c\u0448\u0438\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u0445. \u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-5197) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libvpx \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0435\u043a\u043e\u0432 VP8 \u0438 VP9. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116387","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 nelle implementazioni di riferimento dei codec AV1 e VP8\/VP9 | ProHoster","description":"Nella libreria libaom sviluppata dall'alleanza Open Media (AOMedia), che fornisce un'implementazione di riferimento per il formato di codifica video AV1, \u00e8 stata individuata una vulnerabilit\u00e0 critica (CVE-2024-5171) che porta a un'interruzione.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-etalonnyh-realizacziyah-kodekov-av1-i-vp8-vp9","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043a\u043e\u0434\u0435\u043a\u043e\u0432 AV1 \u0438 VP8\/VP9 | ProHoster","og:description":"\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0430\u043b\u044c\u044f\u043d\u0441\u043e\u043c Open Media (AOMedia) \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libaom, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u0443\u044e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0444\u043e\u0440\u043c\u0430\u0442\u0430 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0438\u0434\u0435\u043e AV1, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-5171), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u043c\u0443.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-etalonnyh-realizacziyah-kodekov-av1-i-vp8-vp9","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-06-06T13:39:51+00:00","article:modified_time":"2024-06-06T13:39:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116387","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 01:52:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 01:52:19","updated":"2026-01-23 01:52:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/116387","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=116387"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/116387\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=116387"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=116387"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=116387"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"