Skip to content
OpenAdvisories
Medium · 5.5 CVE-2024-35369 EUVD-2024-35732GHSA-c655-qv2v-73rm

In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient …

Published Nov 29, 2024 · Updated Nov 29, 2024 · Assigned by mitre

Description

In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 ffmpeg 7:7.0.1-3 —
Debian 13 ffmpeg 7:7.0.1-3 —
Debian 12 ffmpeg No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu Pro 14.04 LTS libav No fix yet —

Advisories 1

References