PT-2022-12335 · Ffjpeg · Ffjpeg

Marsman1996 · Published 2022-02-11 · Updated 2023-08-17 · CVE-2021-45385

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ffjpeg version d5cfd49 (2021-12-06)

Description A Null Pointer Dereference issue exists due to incomplete patching. When size information in the metadata of a bmp file is out of range, the program fails to assign a memory buffer to pb->pdata but continues execution, leading to a crash when trying to access pb->data in jfif encode() at jfif.c:763.

Recommendations For ffjpeg version d5cfd49 (2021-12-06), as a temporary workaround, consider adding a check to ensure pb->pdata is assigned a valid memory buffer before accessing pb->data to prevent the program from crashing. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2021-45385

Affected Products

Ffjpeg

References · 4

• 🔥 https://github.com/rockcarry/ffjpeg/issues/47 · Exploit
• https://github.com/rockcarry/ffjpeg/pull/48 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-45385 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45385 · Vendor Advisory