FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7823-1 advisory.

    It was discovered that FFmpeg did not correctly handle certain memory operations. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected     Ubuntu 24.04 LTS. (CVE-2024-35365)

    It was discovered that FFmpeg did not correctly handle certain integer calculations. An attacker could     possibly use this issue to cause a denial of service. (CVE-2024-35366)

    It was discovered that FFmpeg may perform an out-of-bounds read under certain circumstances. An attacker     could possibly use this issue to cause a denial of service. (CVE-2024-35367)

    It was discovered that FFmpeg did not correctly handle certain memory operations. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-35368)

    It was discovered that FFmpeg did not correctly handle certain inputs, which could lead to an integer     overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary     code. (CVE-2024-36613, CVE-2024-36616, CVE-2024-36618)

    It was discovered that FFmpeg did not correctly handle certain inputs, which could lead to an integer     overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary     code. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-36619)

    It was discovered that FFmpeg did not correctly handle certain memory operations. A remote attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected     Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-7055)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1450-1 advisory.

    - CVE-2025-22921: Clear array length when freeing it. (bsc#1237382)
    - CVE-2025-0518: Fix memory data leak when use sscanf(). (bsc#1236007)
    - CVE-2025-22919: Check for valid sample rate, to fix the invalid sample rate >= 0. (bsc#1237371)
    - CVE-2024-12361: Add check for av_packet_new_side_data() to avoid null pointer dereference if allocation     fails. (bsc#1237358)
    - CVE-2024-36613: Adjust order of operations around block align. (bsc#1235092)
    - CVE-2024-35365: Fix double-free on error. (bsc#1235091)
    - CVE-2024-35368: Fix double-free on the AVFrame is unreferenced. (bsc#1234028)
    - CVE-2023-51793: Fix out of array access. (bsc#1223272).
    - CVE-2023-51793: Fixed a heap buffer overflow in the image_copy_plane function in libavutil/imgutils.c     (bsc#1223272).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of     FFmpeg, specifically within the new_stream_audio function. (CVE-2024-35365)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
270676	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : FFmpeg vulnerabilities (USN-7823-1)	Nessus	Ubuntu Local Security Checks	medium
235182	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ffmpeg (SUSE-SU-2025:1450-1)	Nessus	SuSE Local Security Checks	medium
228320	Linux Distros Unpatched Vulnerability : CVE-2024-35365	Nessus	Misc.	high

Detections

Analytics

CVE-2024-35365

high

Tenable Plugins

medium

medium

high