PT-2019-6448 · FFmpeg+5 · Ffmpeg+5

Published 2019-10-13 · Updated 2024-04-29 · CVE-2021-38094

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FFmpeg version 4.2.1

Description The issue is related to an Integer Overflow vulnerability in the filter sobel function within the libavfilter/vf convolution.c component of the FFmpeg library. This vulnerability can be exploited by attackers to cause a Denial of Service or potentially gain access to confidential data, compromise data integrity, and disrupt service.

Recommendations For FFmpeg version 4.2.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2020-1014

ALT-PU-2020-2032

BDU:2024-09035

CVE-2021-38094

OPENSUSE-SU-2021:3521-1

OPENSUSE-SU-2021_3521-1

OPENSUSE-SU-2024_1468-1

SUSE-SU-2021:3521-1

SUSE-SU-2023:0005-1

SUSE-SU-2024:1468-1

USN-6449-1

USN-6449-2

Affected Products

Alt Linux

Astra Linux

Ffmpeg

Linuxmint

Suse

Ubuntu

References · 159

• 🔥 https://trac.ffmpeg.org/ticket/8263 · Exploit
• https://ubuntu.com/security/CVE-2021-38090 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38092 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-0422SE89 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-38094 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2020-1014 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05271 · Security Note
• https://bdu.fstec.ru/vul/2022-01676 · Security Note
• https://ubuntu.com/security/CVE-2021-38094 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05032 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-20902 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:0005-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38091 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48434 · Security Note
• https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/99f8d32129dd233d4eb2efa44678a0bc44869f23 · Vendor Advisory