CVE-2024-22860: Integer Overflow
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the jpegxlanimreadpacket component in the JPEG XL Animation decoder.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:6.1-1 - Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:5.1.9-0+deb12u1Fixed in 7:7.1.5-0+deb13u1Fixed in 7:9.0.2-4
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22860?
CVE-2024-22860 has a high severity rating due to its potential to allow remote attackers to execute arbitrary code.
How do I fix CVE-2024-22860?
To fix CVE-2024-22860, upgrade to FFmpeg version 6.1 or later.
What components are affected by CVE-2024-22860?
CVE-2024-22860 affects the jpegxl_anim_read_packet component in the JPEG XL Animation decoder of FFmpeg.
Who is at risk from CVE-2024-22860?
Any users or systems running versions of FFmpeg prior to 6.1 are at risk from CVE-2024-22860.
Can CVE-2024-22860 be exploited remotely?
Yes, CVE-2024-22860 can be exploited remotely by attackers to execute arbitrary code.