CVE-2024-35369

In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35369.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / git.ffmpeg.org/ffmpeg.git

Affected ranges

Type

GIT

Repo

https://git.ffmpeg.org/ffmpeg.git

Events

Introduced

e38092ef9395d7049f871ef4d5411eb410e283e0

Last affected

e38092ef9395d7049f871ef4d5411eb410e283e0

Database specific

{
    "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:6.1.1:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "6.1.1"
        },
        {
            "last_affected": "6.1.1"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

6.*

6.1.1

n6.*

n6.1.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-35369.json"

Git / github.com/ffmpeg/ffmpeg

Affected ranges

Type

GIT

Repo

https://github.com/ffmpeg/ffmpeg

Events

Introduced

e38092ef9395d7049f871ef4d5411eb410e283e0

Fixed

0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c

Database specific

{
    "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:6.1.1:*:*:*:*:*:*:*",
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "6.1.1"
        },
        {
            "last_affected": "6.1.1"
        }
    ]
}

Affected versions

6.*

6.1.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-35369.json"