CVE-2024-35369: Integer Overflow

Published Nov 29, 2024

Updated

In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.

Affected Software

2 affected components

FFmpeg FFmpeg

FFmpeg FFmpeg=6.1.1

Remediation

Patch Available

https://github.com/ffmpeg/ffmpeg/commit/0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c

Event History

Nov 29, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-35369?

CVE-2024-35369 has a moderate severity rating due to its potential to cause integer overflow vulnerabilities.

How do I fix CVE-2024-35369?

To fix CVE-2024-35369, it is recommended to upgrade to the latest version of FFmpeg that addresses this vulnerability.

What software is affected by CVE-2024-35369?

CVE-2024-35369 affects FFmpeg version n6.1.1 in the avcodec/speexdec.c module.

What type of vulnerability is CVE-2024-35369?

CVE-2024-35369 is a security vulnerability caused by insufficient parameter validation that may lead to integer overflow.

Can CVE-2024-35369 lead to code execution?

Yes, CVE-2024-35369 may potentially result in undefined behavior, which could lead to code execution under certain conditions.