CVE-2024-56431 Other in n/a
An invalid negative left shift in libtheora is disputed as having no security impact, but patches are available for affected distributions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-56431?
CVE-2024-56431 is a critical vulnerability in n/a, published on 25 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash.
Weakness: CWE-863
Which versions are affected by CVE-2024-56431?
It affects 1 product.
Linux distribution packages (17)
mozjs60 SUSE:Linux Enterprise Micro 5.1 | All versions | 60.9.0-150200.6.3.1 |
mozjs60 SUSE:Linux Enterprise Micro 5.2 | All versions | 60.9.0-150200.6.3.1 |
mozjs60 SUSE:Linux Enterprise Micro 5.3 | All versions | 60.9.0-150200.6.3.1 |
mozjs60 SUSE:Linux Enterprise Micro 5.4 | All versions | 60.9.0-150200.6.3.1 |
mozjs60 SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 60.9.0-150200.6.3.1 |
mozjs115 SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 | All versions | 115.4.0-150600.3.9.1 |
mozjs60 SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 | All versions | 60.9.0-150200.6.3.1 |
mozjs52 SUSE:Linux Enterprise Module for Package Hub 15 SP6 | All versions | 52.6.0-150000.3.6.1 |
mozjs78 SUSE:Linux Enterprise Module for Package Hub 15 SP6 | All versions | 78.15.0-150400.3.14.1 |
mozjs102 SUSE:Package Hub 15 SP6 | All versions | 102.15.1-bp156.3.3.1 |
mozjs102 openSUSE:Leap 15.6 | All versions | 102.15.1-bp156.3.3.1 |
mozjs115 openSUSE:Leap 15.6 | All versions | 115.4.0-150600.3.9.1 |
mozjs52 openSUSE:Leap 15.6 | All versions | 52.6.0-150000.3.6.1 |
mozjs60 openSUSE:Leap 15.6 | All versions | 60.9.0-150200.6.3.1 |
mozjs78 openSUSE:Leap 15.6 | All versions | 78.15.0-150400.3.14.1 |
mozjs115 openSUSE:Tumbleweed | All versions | 115.15.0-5.1 |
mozjs128 openSUSE:Tumbleweed | All versions | 128.9.0-2.1 |
Products include Xiph Theora.
How do I fix CVE-2024-56431?
Apply the vendor's patch.
Is CVE-2024-56431 being exploited?
There is no known exploitation of CVE-2024-56431 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2024-56431, GHSA-8xp8-gmmj-xc8w, OESA-2025-1369, SUSE-SU-2025:1287-1, SUSE-SU-2025:1288-1, SUSE-SU-2025:1340-1 and 4 more.