CVE-2021-33815 — Improper Validation of Array Index in Ffmpeg

CWE-129 — Improper Validation of Array Index4 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.1%
top 69.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
FfmpegDebian Ffmpeg
Timeline
PublishedJun 3
Latest updateMay 24

Description

dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc_count is not strictly checked.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶Ubuntuffmpeg/ffmpeg< 7:4.4.1-3ubuntu2
▶NVDffmpeg/ffmpeg4.4
▶debiandebian/ffmpeg

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-gcpj-pp7m-cw8v: dwa_uncompress in libavcodec/exr↗2022-05-24
▶
OSV
CVE-2021-33815: dwa_uncompress in libavcodec/exr↗2021-06-03
▶

📋Vendor Advisories

1
Debian
CVE-2021-33815: ffmpeg - dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array a...↗2021
▶