CVE-2021-28429
published 2023-08-11CVE-2021-28429: Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service…
PriorityP416medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.20%
9.8th percentile
Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ffmpeg | < ffmpeg 7:4.4-5 (bookworm) | ffmpeg 7:4.4-5 (bookworm) |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | >= 0 < 7:4.3.3-0+deb11u1 | 7:4.3.3-0+deb11u1 |
| ffmpeg | ffmpeg | >= 0 < 7:4.4-5 | 7:4.4-5 |
| ffmpeg | ffmpeg | >= 0 < 7:4.4-5 | 7:4.4-5 |
| ffmpeg | ffmpeg | >= 0 < 7:4.4-5 | 7:4.4-5 |
| ffmpeg | ffmpeg | >= 0 < 7:2.8.17-0ubuntu0.1+esm6 | 7:2.8.17-0ubuntu0.1+esm6 |
| ffmpeg | ffmpeg | >= 0 < 7:3.4.11-0ubuntu0.1+esm2 | 7:3.4.11-0ubuntu0.1+esm2 |
| ffmpeg | ffmpeg | >= 0 < 7:4.2.7-0ubuntu0.1+esm2 | 7:4.2.7-0ubuntu0.1+esm2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_ubuntu6.5MEDIUM
vendor_debian5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ffmpeg vulnerabilities
osv·2023-10-12·CVSS 6.5
CVE-2020-22024 [MEDIUM] ffmpeg vulnerabilities
ffmpeg vulnerabilities
It was discovered that FFmpeg did not properly handle certain inputs in
vf_lagfun.c, resulting in a buffer overflow vulnerability. An attacker
could possibly use this issue to cause a denial of service via application
crash. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-22024)
It was discovered that FFmpeg incorrectly managed memory in avienc.c,
resulting in a memory leak. An attacker could possibly use this issue
to cause a denial of service via application crash. (CVE-2020-22039)
It was discovered that FFmpeg incorrectly handled certain files due to a
memory leak in frame.c. An attacker could possibly use this issue to cause
a denial of service via application crash. This issue affected
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-22040)
It was disco
GHSA
GHSA-9g32-j225-76c5: Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode
ghsa_unreviewed·2023-08-11
CVE-2021-28429 [MEDIUM] CWE-190 GHSA-9g32-j225-76c5: Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode
Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.
OSV
CVE-2021-28429: Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode
osv·2023-08-11·CVSS 5.5
CVE-2021-28429 [MEDIUM] CVE-2021-28429: Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode
Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.
Ubuntu
FFmpeg vulnerabilities
vendor_ubuntu·2023-10-12·CVSS 6.5
CVE-2020-22040 [MEDIUM] FFmpeg vulnerabilities
Title: FFmpeg vulnerabilities
Summary: Several security issues were fixed in FFmpeg.
It was discovered that FFmpeg did not properly handle certain inputs in
vf_lagfun.c, resulting in a buffer overflow vulnerability. An attacker
could possibly use this issue to cause a denial of service via application
crash. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-22024)
It was discovered that FFmpeg incorrectly managed memory in avienc.c,
resulting in a memory leak. An attacker could possibly use this issue
to cause a denial of service via application crash. (CVE-2020-22039)
It was discovered that FFmpeg incorrectly handled certain files due to a
memory leak in frame.c. An attacker could possibly use this issue to cause
a denial of service via application crash. This issue affected
Ubuntu
Debian
CVE-2021-28429: ffmpeg - Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode....
vendor_debian·2021·CVSS 5.5
CVE-2021-28429 [MEDIUM] CVE-2021-28429: ffmpeg - Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode....
Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.
Scope: local
bookworm: resolved (fixed in 7:4.4-5)
bullseye: resolved (fixed in 7:4.3.3-0+deb11u1)
forky: resolved (fixed in 7:4.4-5)
sid: resolved (fixed in 7:4.4-5)
trixie: resolved (fixed in 7:4.4-5)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-08-11
Published