Integer Overflow Vulnerability in FFmpeg: Denial of Service Risk
Summary
DEBIAN-CVE-2024-22861: Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module. Affects ffmpeg versions < 7:6.1-1. Fixed in 7:6.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a powerful open-source multimedia framework that allows users to record, convert, and stream audio and video. It is widely used for its versatility and support for numerous formats. However, like many complex software systems, FFmpeg is susceptible to vulnerabilities that can be exploited by attackers. The specific vulnerability in question is an integer overflow that can lead to a denial of service (DoS) attack, affecting the stability and availability of applications relying on FFmpeg.
Vulnerability Detail
The integer overflow vulnerability in FFmpeg, present in versions before 6.1, originates from the avcodec/osq module. This flaw allows attackers to craft malicious inputs that, when processed by FFmpeg, can cause the application to crash or become unresponsive, resulting in a denial of service. The vulnerability is critical as it can be exploited remotely, potentially affecting a wide range of applications that utilize FFmpeg for media processing.
How To Fix
Minimum fixed version
7:6.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted or unknown media files with FFmpeg until the update is applied. Additionally, implementing input validation on media files before processing can help mitigate the risk.
Conclusion
The integer overflow vulnerability in FFmpeg poses a significant risk of denial of service attacks. Users are strongly advised to update to the patched version 7:6.1-1 or later to mitigate this risk. Until the update is applied, users should exercise caution when processing media files and consider implementing workarounds.
See every vulnerability recorded for ffmpeg →
FAQ
The vulnerability is an integer overflow that can lead to a denial of service (DoS) when processing certain inputs in FFmpeg.
FFmpeg versions prior to 6.1 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If an immediate update is not possible, avoid processing untrusted media files and implement input validation as a temporary measure.
Yes, Vulert can automate vulnerability checks using a manifest file like package-lock.json, allowing for real-time monitoring without code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
