CVE-2024-31582: Buffer Overflow
FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the drawblockrectangle function of libavfilter/vfcodecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ffmpegto a version that resolves this vulnerability.Fixed in 7:6.0-6ubuntu1.1 - Upgrade
Upgrade
ubuntu/ffmpegto a version that resolves this vulnerability.Fixed in 7:6.1.1-3ubuntu5+ - Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:5.1.7-0+deb12u1 - Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:7.0.1-3 - Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:5.1.9-0+deb12u1Fixed in 7:7.1.5-0+deb13u1Fixed in 7:9.0.2-4 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 7.1.1-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31582?
CVE-2024-31582 has been classified as a high severity vulnerability due to its potential to cause undefined behavior and Denial of Service.
How do I fix CVE-2024-31582?
To mitigate CVE-2024-31582, update FFmpeg to version 7:6.1.1-3ubuntu5+ or a later version, or use 7:6.0-6ubuntu1.1 for Ubuntu.
Which versions of FFmpeg are affected by CVE-2024-31582?
CVE-2024-31582 affects FFmpeg version n6.1 and earlier.
What impact does CVE-2024-31582 have on systems?
CVE-2024-31582 can lead to undefined behavior or Denial of Service when processing specially crafted inputs.
Is there a workaround for CVE-2024-31582?
There are no known workarounds for CVE-2024-31582; updating to a patched version is recommended.