CVE-2024-36616: Integer Overflow
An integer overflow in the component /libavformat/westwoodvqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:5.1.5-0+deb12u1 - Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:7.0.1-3 - Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:5.1.9-0+deb12u1Fixed in 7:7.1.5-0+deb13u1Fixed in 7:9.0.2-4
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36616?
CVE-2024-36616 is classified as a denial of service vulnerability.
How do I fix CVE-2024-36616?
To fix CVE-2024-36616, upgrade to a patched version of FFmpeg beyond 6.1.1.
What causes CVE-2024-36616?
CVE-2024-36616 is caused by an integer overflow in the westwood_vqa.c component of FFmpeg.
Which versions of FFmpeg are affected by CVE-2024-36616?
Only FFmpeg version 6.1.1 is reported as affected by CVE-2024-36616.
Can CVE-2024-36616 be exploited remotely?
Yes, CVE-2024-36616 can be exploited remotely through a crafted VQA file.