CVE-2024-31585 — Off-by-one Error in Ffmpeg

CWE-193 — Off-by-one Error7 documents6 sources
Severity
5.3MEDIUMNVD
OSV8.0
EPSS
0.0%
top 93.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FfmpegFedoraproject Fedora
Timeline
PublishedApr 17
Latest updateMay 30

Description

FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:HExploitability: 0.8 | Impact: 4.0

Affected Packages3 packages

▶NVDffmpeg/ffmpeg5.1 — 7.0
▶Debianffmpeg/ffmpeg< 7:5.1.5-0+deb12u1+2
▶Ubuntuffmpeg/ffmpeg< 7:2.8.17-0ubuntu0.1+esm7+4

Also affects: Fedora 38, 39, 40

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
ffmpeg vulnerabilities↗2024-05-30
▶
CVEList
CVE-2024-31585: FFmpeg version n5↗2024-04-17
▶
OSV
CVE-2024-31585: FFmpeg version n5↗2024-04-17
▶
GHSA
GHSA-vh9p-h4p4-q9vv: FFmpeg version n5↗2024-04-17
▶

📋Vendor Advisories

2
Ubuntu
FFmpeg vulnerabilities↗2024-05-30
▶
Debian
CVE-2024-31585: ffmpeg - FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulner...↗2024
▶
CVE-2024-31585 — Off-by-one Error in Ffmpeg | cvebase