Integer overflow in FFmpeg - CVE-2024-22860

Vulnerability identifier: #VU92203

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-22860

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the jpegxl_anim_read_packet component in the JPEG XL Animation decoder. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system via the jpegxl_anim_read_packet component in the JPEG XL Animation decoder.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

FFmpeg
Telemetry Dashboard
IBM Watson Machine Learning Accelerator
Liquidware
Citrix Workspace App
Webex App VDI
Cisco Jabber
Cisco Webex Meetings
VMware Horizon Client

Install updates from vendor's website.

FFmpeg - update to 6.1
Telemetry Dashboard - update to 1.1.0.6 on Thin OS 2405
IBM Watson Machine Learning Accelerator - update to 5.0.3
Liquidware - update to 6.7.0.2.2 on Thin OS 2405
Cisco Jabber - update to 14.3.0.308378.11 on Thin OS 2405
Citrix Workspace App - update to 24.2.0.65.17 on Thin OS 2405
Webex App VDI - update to 44.2.0.28744.1 on Thin OS 2405
Cisco Webex Meetings - update to 44.2.0.76.2 on Thin OS 2405
VMware Horizon Client - update to 2312.1.8.12.1.5 on Thin OS 2405

• https://github.com/FFmpeg/FFmpeg/commit/d2e8974699a9e35cc1a926bf74a972300d629cd5
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61991

• Multiple vulnerabilities in Dell ThinOS
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data