Buffer overflow in FFmpeg - CVE-2024-32230

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU94649

Buffer overflow in FFmpeg - CVE-2024-32230

Published: July 22, 2024


Vulnerability identifier: #VU94649
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-32230
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the load_input_picture() function in libavcodec/mpegvideo_enc.c. A remote attacker can create a specially crafted media file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

FFmpeg
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro
SUSE Package Hub 15
Desktop Applications Module
openSUSE Leap
Ubuntu
openEuler
libswresample4 (Ubuntu package)
libswresample3 (Ubuntu package)
libpostproc55 (Ubuntu package)
libavutil56 (Ubuntu package)
libavformat58 (Ubuntu package)
libavformat-extra58 (Ubuntu package)
libavfilter7 (Ubuntu package)
libavfilter-extra7 (Ubuntu package)
libavdevice58 (Ubuntu package)
libavcodec58 (Ubuntu package)
libavcodec-extra58 (Ubuntu package)
libswscale7 (Ubuntu package)
libswscale-ffmpeg3 (Ubuntu package)
libpostproc57 (Ubuntu package)
libavutil58 (Ubuntu package)
libavformat60 (Ubuntu package)
libavformat-extra60 (Ubuntu package)
libavfilter9 (Ubuntu package)
libavfilter-extra9 (Ubuntu package)
libavdevice60 (Ubuntu package)
libavcodec60 (Ubuntu package)
libavcodec-extra60 (Ubuntu package)
libavcodec-dev (Ubuntu package)
ffmpeg (Ubuntu package)
libavresample4 (Ubuntu package)
libswscale5 (Ubuntu package)
libswresample-ffmpeg1 (Ubuntu package)
libpostproc-ffmpeg53 (Ubuntu package)
libavutil-ffmpeg54 (Ubuntu package)
libavresample-ffmpeg2 (Ubuntu package)
libavformat-ffmpeg56 (Ubuntu package)
libavfilter-ffmpeg5 (Ubuntu package)
libavdevice-ffmpeg56 (Ubuntu package)
libavcodec-ffmpeg56 (Ubuntu package)
libavcodec-ffmpeg-extra56 (Ubuntu package)
libav-tools (Ubuntu package)
libswresample2 (Ubuntu package)
libswscale4 (Ubuntu package)
libavcodec-extra57 (Ubuntu package)
libavcodec57 (Ubuntu package)
libavdevice57 (Ubuntu package)
libavfilter-extra6 (Ubuntu package)
libavfilter6 (Ubuntu package)
libavformat57 (Ubuntu package)
libavresample3 (Ubuntu package)
libavutil55 (Ubuntu package)
libpostproc54 (Ubuntu package)
libswscale4
ffmpeg-private-devel
libswresample-devel
libavutil-devel
libavresample3
libavformat57-debuginfo
libavformat57
libpostproc54-debuginfo
libavcodec57-debuginfo
libavresample-devel
ffmpeg
libavformat-devel
libavresample3-debuginfo
libswscale-devel
libswresample2
libavdevice-devel
libswscale4-debuginfo
libavfilter6-debuginfo
ffmpeg-debuginfo
libpostproc-devel
libavutil55-debuginfo
libavutil55
libavfilter-devel
libswscale4-32bit-debuginfo
libavfilter6
libavresample3-32bit
libavresample3-32bit-debuginfo
libavformat57-32bit-debuginfo
libavcodec57-32bit
libavformat57-32bit
libswscale4-32bit
libavcodec57-32bit-debuginfo
libswresample2-32bit
libavdevice57-32bit
libavutil55-32bit-debuginfo
libswresample2-32bit-debuginfo
libpostproc54-32bit-debuginfo
libavdevice57
libavdevice57-32bit-debuginfo
libavfilter6-32bit-debuginfo
libavfilter6-32bit
libpostproc54-32bit
libavutil55-32bit
libpostproc54
libswresample2-debuginfo
libavdevice57-debuginfo
ffmpeg-debugsource
libavcodec-devel
libavcodec57
libavdevice
ffmpeg-libs
ffmpeg-devel
ffmpeg-4-libswresample-devel
ffmpeg-4-libavdevice-devel
ffmpeg-4-private-devel
libavdevice58_13
libavdevice58_13-debuginfo
libpostproc55_9-debuginfo
ffmpeg-4-libavutil-devel
libavcodec58_134-debuginfo
libavresample4_0
libswresample3_9-debuginfo
libpostproc55_9
libpostproc55_9-64bit-debuginfo
libavfilter7_110-debuginfo
ffmpeg-4-libavcodec-devel
ffmpeg-4-debugsource
libavcodec58_134
ffmpeg-4-debuginfo
libavformat58_76
ffmpeg-4-libavresample-devel
ffmpeg-4-libavfilter-devel
libavformat58_76-debuginfo
libswresample3_9
libavresample4_0-32bit
libavfilter7_110-32bit
libavutil56_70-32bit-debuginfo
libswscale5_9-32bit-debuginfo
libavfilter7_110-32bit-debuginfo
libavcodec58_134-32bit-debuginfo
libavdevice58_13-32bit
libavdevice58_13-32bit-debuginfo
libavformat58_76-32bit
libpostproc55_9-32bit
libswscale5_9-32bit
libpostproc55_9-32bit-debuginfo
libavutil56_70-32bit
libavresample4_0-32bit-debuginfo
libswresample3_9-32bit-debuginfo
ffmpeg-4
libavresample4_0-debuginfo
libswscale5_9-debuginfo
ffmpeg-4-libswscale-devel
ffmpeg-4-libpostproc-devel
libswscale5_9
libswresample3_9-64bit
libpostproc55_9-64bit
libavutil56_70-64bit
libavdevice58_13-64bit
libavresample4_0-64bit
libavdevice58_13-64bit-debuginfo
libavfilter7_110-64bit-debuginfo
libavcodec58_134-64bit
libavcodec58_134-64bit-debuginfo
libswscale5_9-64bit-debuginfo
libswscale5_9-64bit
libavutil56_70-debuginfo
libavutil56_70-64bit-debuginfo
libavresample4_0-64bit-debuginfo
libavformat58_76-64bit-debuginfo
libavfilter7_110-64bit
libavformat58_76-64bit
libswresample3_9-64bit-debuginfo
libavformat58_76-32bit-debuginfo
libswresample3_9-32bit
libavcodec58_134-32bit
libavfilter7_110
ffmpeg-4-libavformat-devel
libavutil56_70

How to mitigate CVE-2024-32230

Install updates from vendor's website.

FFmpeg - update to 7.0.1
libswresample4 (Ubuntu package) - update to Ubuntu Pro
libswresample3 (Ubuntu package) - update to Ubuntu Pro
libpostproc55 (Ubuntu package) - update to Ubuntu Pro
libavutil56 (Ubuntu package) - update to Ubuntu Pro
libavformat58 (Ubuntu package) - update to Ubuntu Pro
libavformat-extra58 (Ubuntu package) - update to Ubuntu Pro
libavfilter7 (Ubuntu package) - update to Ubuntu Pro
libavfilter-extra7 (Ubuntu package) - update to Ubuntu Pro
libavdevice58 (Ubuntu package) - update to Ubuntu Pro
libavcodec58 (Ubuntu package) - update to Ubuntu Pro
libavcodec-extra58 (Ubuntu package) - update to Ubuntu Pro
libswscale7 (Ubuntu package) - update to Ubuntu Pro
libswscale-ffmpeg3 (Ubuntu package) - update to Ubuntu Pro
libpostproc57 (Ubuntu package) - update to Ubuntu Pro
libavutil58 (Ubuntu package) - update to Ubuntu Pro
libavformat60 (Ubuntu package) - update to Ubuntu Pro
libavformat-extra60 (Ubuntu package) - update to Ubuntu Pro
libavfilter9 (Ubuntu package) - update to Ubuntu Pro
libavfilter-extra9 (Ubuntu package) - update to Ubuntu Pro
libavdevice60 (Ubuntu package) - update to Ubuntu Pro
libavcodec60 (Ubuntu package) - update to Ubuntu Pro
libavcodec-extra60 (Ubuntu package) - update to Ubuntu Pro
libavcodec-dev (Ubuntu package) - update to Ubuntu Pro
ffmpeg (Ubuntu package) - update to Ubuntu Pro
libavresample4 (Ubuntu package) - update to Ubuntu Pro
libswscale5 (Ubuntu package) - update to Ubuntu Pro
libswresample-ffmpeg1 (Ubuntu package) - update to Ubuntu Pro
libpostproc-ffmpeg53 (Ubuntu package) - update to Ubuntu Pro
libavutil-ffmpeg54 (Ubuntu package) - update to Ubuntu Pro
libavresample-ffmpeg2 (Ubuntu package) - update to Ubuntu Pro
libavformat-ffmpeg56 (Ubuntu package) - update to Ubuntu Pro
libavfilter-ffmpeg5 (Ubuntu package) - update to Ubuntu Pro
libavdevice-ffmpeg56 (Ubuntu package) - update to Ubuntu Pro
libavcodec-ffmpeg56 (Ubuntu package) - update to Ubuntu Pro
libavcodec-ffmpeg-extra56 (Ubuntu package) - update to Ubuntu Pro
libav-tools (Ubuntu package) - update to Ubuntu Pro
libswresample2 (Ubuntu package) - update to Ubuntu Pro
libswscale4 (Ubuntu package) - update to Ubuntu Pro
libavcodec-extra57 (Ubuntu package) - update to Ubuntu Pro
libavcodec57 (Ubuntu package) - update to Ubuntu Pro
libavdevice57 (Ubuntu package) - update to Ubuntu Pro
libavfilter-extra6 (Ubuntu package) - update to Ubuntu Pro
libavfilter6 (Ubuntu package) - update to Ubuntu Pro
libavformat57 (Ubuntu package) - update to Ubuntu Pro
libavresample3 (Ubuntu package) - update to Ubuntu Pro
libavutil55 (Ubuntu package) - update to Ubuntu Pro
libpostproc54 (Ubuntu package) - update to Ubuntu Pro
libswscale4 - update to 3.4.2-150200.11.50.1
ffmpeg-private-devel - update to 3.4.2-150200.11.50.1
libswresample-devel - update to 3.4.2-150200.11.50.1
libavutil-devel - update to 3.4.2-150200.11.50.1
libavresample3 - update to 3.4.2-150200.11.50.1
libavformat57-debuginfo - update to 3.4.2-150200.11.50.1
libavformat57 - update to 3.4.2-150200.11.50.1
libpostproc54-debuginfo - update to 3.4.2-150200.11.50.1
libavcodec57-debuginfo - update to 3.4.2-150200.11.50.1
libavresample-devel - update to 3.4.2-150200.11.50.1
ffmpeg - update to 3.4.2-150200.11.50.1
libavformat-devel - update to 3.4.2-150200.11.50.1
libavresample3-debuginfo - update to 3.4.2-150200.11.50.1
libswscale-devel - update to 3.4.2-150200.11.50.1
libswresample2 - update to 3.4.2-150200.11.50.1
libavdevice-devel - update to 3.4.2-150200.11.50.1
libswscale4-debuginfo - update to 3.4.2-150200.11.50.1
libavfilter6-debuginfo - update to 3.4.2-150200.11.50.1
ffmpeg-debuginfo - update to 3.4.2-150200.11.50.1
libpostproc-devel - update to 3.4.2-150200.11.50.1
libavutil55-debuginfo - update to 3.4.2-150200.11.50.1
libavutil55 - update to 3.4.2-150200.11.50.1
libavfilter-devel - update to 3.4.2-150200.11.50.1
libswscale4-32bit-debuginfo - update to 3.4.2-150200.11.50.1
libavfilter6 - update to 3.4.2-150200.11.50.1
libavresample3-32bit - update to 3.4.2-150200.11.50.1
libavresample3-32bit-debuginfo - update to 3.4.2-150200.11.50.1
libavformat57-32bit-debuginfo - update to 3.4.2-150200.11.50.1
libavcodec57-32bit - update to 3.4.2-150200.11.50.1
libavformat57-32bit - update to 3.4.2-150200.11.50.1
libswscale4-32bit - update to 3.4.2-150200.11.50.1
libavcodec57-32bit-debuginfo - update to 3.4.2-150200.11.50.1
libswresample2-32bit - update to 3.4.2-150200.11.50.1
libavdevice57-32bit - update to 3.4.2-150200.11.50.1
libavutil55-32bit-debuginfo - update to 3.4.2-150200.11.50.1
libswresample2-32bit-debuginfo - update to 3.4.2-150200.11.50.1
libpostproc54-32bit-debuginfo - update to 3.4.2-150200.11.50.1
libavdevice57 - update to 3.4.2-150200.11.50.1
libavdevice57-32bit-debuginfo - update to 3.4.2-150200.11.50.1
libavfilter6-32bit-debuginfo - update to 3.4.2-150200.11.50.1
libavfilter6-32bit - update to 3.4.2-150200.11.50.1
libpostproc54-32bit - update to 3.4.2-150200.11.50.1
libavutil55-32bit - update to 3.4.2-150200.11.50.1
libpostproc54 - update to 3.4.2-150200.11.50.1
libswresample2-debuginfo - update to 3.4.2-150200.11.50.1
libavdevice57-debuginfo - update to 3.4.2-150200.11.50.1
ffmpeg-debugsource - update to 3.4.2-150200.11.50.1
libavcodec-devel - update to 3.4.2-150200.11.50.1
libavcodec57 - update to 3.4.2-150200.11.50.1
ffmpeg-debuginfo - addressed in versions 4.2.4-17, 6.1.1-11
ffmpeg - addressed in versions 4.2.4-17, 6.1.1-11
libavdevice - addressed in versions 4.2.4-17, 6.1.1-11
ffmpeg-libs - addressed in versions 4.2.4-17, 6.1.1-11
ffmpeg-devel - addressed in versions 4.2.4-17, 6.1.1-11
ffmpeg-debugsource - addressed in versions 4.2.4-17, 6.1.1-11
ffmpeg-4-libswresample-devel - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
ffmpeg-4-libavdevice-devel - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
ffmpeg-4-private-devel - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavdevice58_13 - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavdevice58_13-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libpostproc55_9-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
ffmpeg-4-libavutil-devel - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavcodec58_134-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavresample4_0 - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libswresample3_9-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libpostproc55_9 - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libpostproc55_9-64bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavfilter7_110-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
ffmpeg-4-libavcodec-devel - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
ffmpeg-4-debugsource - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavcodec58_134 - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
ffmpeg-4-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavformat58_76 - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
ffmpeg-4-libavresample-devel - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
ffmpeg-4-libavfilter-devel - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavformat58_76-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libswresample3_9 - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavresample4_0-32bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavfilter7_110-32bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavutil56_70-32bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libswscale5_9-32bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavfilter7_110-32bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavcodec58_134-32bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavdevice58_13-32bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavdevice58_13-32bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavformat58_76-32bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libpostproc55_9-32bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libswscale5_9-32bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libpostproc55_9-32bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavutil56_70-32bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavresample4_0-32bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libswresample3_9-32bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
ffmpeg-4 - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavresample4_0-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libswscale5_9-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
ffmpeg-4-libswscale-devel - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
ffmpeg-4-libpostproc-devel - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libswscale5_9 - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libswresample3_9-64bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libpostproc55_9-64bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavutil56_70-64bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavdevice58_13-64bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavresample4_0-64bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavdevice58_13-64bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavfilter7_110-64bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavcodec58_134-64bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavcodec58_134-64bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libswscale5_9-64bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libswscale5_9-64bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavutil56_70-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavutil56_70-64bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavresample4_0-64bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavformat58_76-64bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavfilter7_110-64bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavformat58_76-64bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libswresample3_9-64bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavformat58_76-32bit-debuginfo - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libswresample3_9-32bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavcodec58_134-32bit - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavfilter7_110 - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
ffmpeg-4-libavformat-devel - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1
libavutil56_70 - addressed in versions 4.4-150400.3.37.1, 4.4-150600.13.10.1

External References

Related Security Bulletins