DEBIAN-CVE-2024-35366

FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.

References

https://security-tracker.debian.org/tracker/CVE-2024-35366

Affected packages

Debian:12 / ffmpeg

Package

Name: ffmpeg
Purl: pkg:deb/debian/ffmpeg?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

7:5.1.5-0+deb12u1

Affected versions

7:5.*

7:5.1.3-1

7:5.1.3-2

7:5.1.4-0+deb12u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-35366.json"

Debian:13 / ffmpeg

Package

Name: ffmpeg
Purl: pkg:deb/debian/ffmpeg?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

7:7.0.1-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-35366.json"

Debian:14 / ffmpeg

Package

Name: ffmpeg
Purl: pkg:deb/debian/ffmpeg?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

7:7.0.1-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-35366.json"