I den av Open Media (AOMedia) utvecklade biblioteket libaom, som tillhandah\u00e5ller en referensimplementation av video kodningsformatet AV1, har en kritisk s\u00e5rbarhet uppt\u00e4ckts (CVE-2024-5171) som leder till heltals\u00f6verfl\u00f6d och skrivning utanf\u00f6r buffertens gr\u00e4nser vid behandling av f\u00f6r stora v\u00e4rden i vissa parametrar. En liknande s\u00e5rbarhet (CVE-2024-5197) har uppt\u00e4ckts i biblioteket libvpx med implementationen av codec:arna VP8 och VP9. Problemet har \u00e5tg\u00e4rdats i uppdateringarna libaom 3.9.0 och libvpx 1.14.1. S\u00e5rbarheterna kvarst\u00e5r fortfarande o\u00e5tg\u00e4rdade i distributionerna (Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD). <\/p>\n
S\u00e5rbarheterna i libaom har tilldelats h\u00f6gsta riskniv\u00e5 (10 av 10), vilket inneb\u00e4r att de kan utnyttjas vid behandling i applikationer som anv\u00e4nder detta bibliotek med speciellt utformat inneh\u00e5ll. I libvpx s\u00e4tts riskniv\u00e5n till 5,9 av 10, vilket motsvarar begr\u00e4nsade utnyttjandef\u00f6rh\u00e5llanden. Den huvudsakliga faran med s\u00e5rbarheterna i libaom och libvpx beror p\u00e5 att dessa bibliotek anv\u00e4nds i webbl\u00e4sare, mediespelare och tj\u00e4nster som utf\u00f6r videokodning. <\/p>\n
S\u00e5rbarheten manifesterar sig i libaom n\u00e4r funktionerna aom_img_alloc(), aom_img_wrap() eller om_img_alloc_with_border() anropas med stora v\u00e4rden i parametrarna d_w, d_h och align, vilket leder till heltals\u00f6verfl\u00f6d vid ber\u00e4kning av f\u00f6rskjutningar och buffertstorlekar. Ett liknande \u00f6verfl\u00f6d uppst\u00e5r i funktionerna vpx_img_alloc() och vpx_img_wrap(). De angivna funktionerna anv\u00e4nds vid videokodning. <\/p>\n
S\u00e5rbarheten utg\u00f6r den st\u00f6rsta faran p\u00e5 grund av den potentiella m\u00f6jligheten till attacker mot webbl\u00e4sare, d\u00e4r tidigare liknande s\u00e5rbarheter kan ha utnyttjats genom att \u00f6ppna en s\u00e4rskilt utformad webbsida i webbl\u00e4saren, vilket kallar JavaScript-funktioner f\u00f6r videokodning, eller genom hantering av WebRTC. Enligt f\u00f6retr\u00e4dare f\u00f6r Google p\u00e5verkar inte s\u00e5rbarheten Chromium-motorn, eftersom endast verifierade v\u00e4rden f\u00f6r argumenten d_w och d_h passerade till funktionerna aom_img_alloc(), aom_img_wrap(), vpx_img_alloc() och vpx_img_wrap(). F\u00f6r AV1-dekodning i Firefox anv\u00e4nds biblioteket dav1d, men vid kodning anv\u00e4nds libaom. Huruvida Firefox \u00e4r p\u00e5verkat av problemet \u00e4r f\u00f6r n\u00e4rvarande oklart, eftersom informationen om hur s\u00e5rbarheten p\u00e5verkar specifika produkter \u00e4nnu inte har publicerats. \u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0430\u043b\u044c\u044f\u043d\u0441\u043e\u043c Open Media (AOMedia) \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libaom, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u0443\u044e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0444\u043e\u0440\u043c\u0430\u0442\u0430 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0438\u0434\u0435\u043e AV1, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-5171), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u044c \u0432\u043d\u0435 \u0433\u0440\u0430\u043d\u0438\u0446 \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u0431\u043e\u043b\u044c\u0448\u0438\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u0445. \u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-5197) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libvpx \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0435\u043a\u043e\u0432 VP8 \u0438 VP9. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116387","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhet i referensimplementeringar av AV1 och VP8\/VP9-codecs | ProHoster","description":"I det av utvecklade alliansen Open Media (AOMedia) biblioteket libaom, som tillhandah\u00e5ller en referensimplementering av videokodningsformatet AV1, har en kritisk s\u00e5rbarhet (CVE-2024-5171) identifierats, vilket leder till heltal.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-etalonnyh-realizacziyah-kodekov-av1-i-vp8-vp9","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043a\u043e\u0434\u0435\u043a\u043e\u0432 AV1 \u0438 VP8\/VP9 | ProHoster","og:description":"\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0430\u043b\u044c\u044f\u043d\u0441\u043e\u043c Open Media (AOMedia) \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libaom, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u0443\u044e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0444\u043e\u0440\u043c\u0430\u0442\u0430 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0438\u0434\u0435\u043e AV1, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-5171), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u043c\u0443.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-etalonnyh-realizacziyah-kodekov-av1-i-vp8-vp9","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-06-06T13:39:51+00:00","article:modified_time":"2024-06-06T13:39:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116387","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 01:52:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 01:52:19","updated":"2026-01-23 01:52:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/116387","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=116387"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/116387\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=116387"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=116387"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=116387"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"