Out-of-bounds read in FFmpeg - CVE-2024-35367

Vulnerability identifier: #VU117351

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-35367

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in libavcodec/ppc/vp8dsp_altivec.c. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system.

FFmpeg
Debian Linux
Ubuntu
openEuler
ffmpeg (Ubuntu package)
ffmpeg
ffmpeg-debuginfo
ffmpeg-debugsource
ffmpeg-devel
ffmpeg-libs
libavdevice
ffmpeg (Debian package)

Install updates from vendor's website.

FFmpeg - update to 7.0
ffmpeg (Ubuntu package) - addressed in versions 7:2.8.17-0ubuntu0.1+esm12, 7:3.4.11-0ubuntu0.1+esm10, 7:4.2.7-0ubuntu0.1+esm10, 7:4.4.2-0ubuntu0.22.04.1+esm9, 7:6.1.1-3ubuntu5+esm5
ffmpeg - update to 4.2.4-19
ffmpeg-debuginfo - update to 4.2.4-19
ffmpeg-debugsource - update to 4.2.4-19
ffmpeg-devel - update to 4.2.4-19
ffmpeg-libs - update to 4.2.4-19
libavdevice - update to 4.2.4-19
ffmpeg (Debian package) - update to 7:5.1.7-0+deb12u1

• https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4
• https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53
• https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667

• Multiple vulnerabilities in FFmpeg
• Ubuntu update for ffmpeg
• Debian update for ffmpeg
• openEuler update for ffmpeg