Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-35369: FFmpeg: Unvalidated Parameters in Speex Codec Parsing

CVE-2024-35369 · published 1 year ago

Summary

A security issue exists in FFmpeg's handling of Speex codec data, which could lead to crashes or unexpected behavior when decoding. This affects older versions of FFmpeg. To stay secure, update to the latest version.

What to do

Update debian ffmpeg to version 7:7.0.1-3.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	ffmpeg	ffmpeg	6.1.1 `cpe:2.3:a:ffmpeg:ffmpeg:6.1.1:::::::*`
Debian:12	debian	ffmpeg	All versions
Debian:13	debian	ffmpeg	< 7:7.0.1-3 Fix: upgrade to 7:7.0.1-3

Original advisory text

In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.

References

https://gist.github.com/1047524396/455093807666f2e351d674750c8cd0b8 URL
https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/speexdec.c#L1423 URL
https://github.com/ffmpeg/ffmpeg/commit/0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35369... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-35369 Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2024-35369 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-190Integer Overflow

Timeline

Published29 Nov 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-35369 · NVD

CVE-2024-35369 · OSV

DEBIAN-CVE-2024-35369 · OSV

Track software like this

Free during beta