Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2024-7272
PUBLISHED
More InfoOfficial Page
Assigner-VulDB
Assigner Org ID-1af790b2-7ee1-4545-860a-a788eba489b5
View Known Exploited Vulnerability (KEV) details
Published At-08 Aug, 2024 | 20:24
Updated At-09 Aug, 2024 | 17:22
Rejected At-
▼CVE Numbering Authority (CNA)
FFmpeg swresample.c fill_audiodata heap-based overflow

A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. This affects the function fill_audiodata of the file /libswresample/swresample.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. This issue was fixed in version 6.0 by 9903ba28c28ab18dc7b7b6fb8571cc8b5caae1a6 but a backport for 5.1 was forgotten. The exploit has been disclosed to the public and may be used. Upgrading to version 5.1.6 and 6.0 9903ba28c28ab18dc7b7b6fb8571cc8b5caae1a6 is able to address this issue. It is recommended to upgrade the affected component.

Affected Products
Vendor
n/a
Product
FFmpeg
Versions
Affected
  • 5.1.0
  • 5.1.1
  • 5.1.2
  • 5.1.3
  • 5.1.4
  • 5.1.5
Problem Types
TypeCWE IDDescription
CWECWE-122CWE-122 Heap-based Buffer Overflow
Metrics
VersionBase scoreBase severityVector
4.06.9MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
3.16.3MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
3.06.3MEDIUM
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
2.07.5N/A
AV:N/AC:L/Au:N/C:P/I:P/A:P
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
CVE reserved2024-07-30 00:00:00
Advisory disclosed2024-08-08 00:00:00
VulDB entry created2024-08-08 02:00:00
VulDB entry last update2024-08-08 18:00:30
Replaced By

Rejected Reason

References
HyperlinkResource
https://vuldb.com/?id.273945
vdb-entry
technical-description
https://vuldb.com/?ctiid.273945
signature
permissions-required
https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc5
exploit
https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc6
exploit
https://ffmpeg.org/
product
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Vendor
FFmpegffmpeg
Product
ffmpeg
CPEs
  • cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From 5.1.0 through 5.1.5 (custom)
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
Details not found