VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0972 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-32570:
    VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash,     related to dav1d_decode_frame_exit.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash,     related to dav1d_decode_frame_exit. (CVE-2023-32570)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202310-05 (dav1d: Denial of Service)

  - VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash,     related to dav1d_decode_frame_exit. (CVE-2023-32570)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-652b6e8847 advisory.

    Update to version 1.2.1.

    This version includes a fix for CVE-2023-32570 (race condition that can lead to an application crash).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2618-1 advisory.

  - VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash,     related to dav1d_decode_frame_exit. (CVE-2023-32570)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-9ea5d6e289 advisory.

    Update to version 1.2.1.

    This version includes a fix for CVE-2023-32570 (race condition that can lead to an application crash).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 113.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-16 advisory.

  - Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla     Fuzzing Team reported memory safety bugs present in Firefox 112. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2023-32216)

  - In multiple cases browser prompts could have been obscured by popups controlled by content. These could     have led to potential user confusion and spoofing attacks. (CVE-2023-32205)

  - An out-of-bound read could have led to a crash in the RLBox Expat driver. (CVE-2023-32206)

  - A missing delay in popup notifications could have made it possible for an attacker to trick a user into     granting permissions. (CVE-2023-32207)

  - Service workers could reveal script base URL due to dynamic <code>import()</code>. (CVE-2023-32208)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 113.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-16 advisory.

  - Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla     Fuzzing Team reported memory safety bugs present in Firefox 112. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2023-32216)

  - In multiple cases browser prompts could have been obscured by popups controlled by content. These could     have led to potential user confusion and spoofing attacks. (CVE-2023-32205)

  - An out-of-bound read could have led to a crash in the RLBox Expat driver. (CVE-2023-32206)

  - A missing delay in popup notifications could have made it possible for an attacker to trick a user into     granting permissions. (CVE-2023-32207)

  - Service workers could reveal script base URL due to dynamic <code>import()</code>. (CVE-2023-32208)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
239594	TencentOS Server 4: dav1d (TSSA-2024:0972)	Nessus	Tencent Local Security Checks	medium
226784	Linux Distros Unpatched Vulnerability : CVE-2023-32570	Nessus	Misc.	medium
182751	GLSA-202310-05 : dav1d: Denial of Service	Nessus	Gentoo Local Security Checks	medium
178038	Fedora 37 : dav1d (2023-652b6e8847)	Nessus	Fedora Local Security Checks	medium
177611	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : dav1d (SUSE-SU-2023:2618-1)	Nessus	SuSE Local Security Checks	medium
177589	Fedora 38 : dav1d (2023-9ea5d6e289)	Nessus	Fedora Local Security Checks	medium
175330	Mozilla Firefox < 113.0	Nessus	Windows	critical
175329	Mozilla Firefox < 113.0	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2023-32570

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

critical

critical