PT-2022-6564 · Ffjpeg · Ffjpeg

Cem Onat Karagun · Published 2022-02-08 · Updated 2023-08-17 · CVE-2021-44957

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ffjpeg versions prior to 01.01.2021

Description The issue is a global buffer overflow that could cause a Denial of Service by using a crafted jpeg file. It is similar to a previously known issue. The problem lies in the jfif encode function at ffjpeg/src/jfif.c (line 708), which is related to the copying of a buffer without checking the size of the input data. This could allow a remote attacker to cause a service disruption.

Recommendations For versions prior to 01.01.2021, as a temporary workaround, consider disabling the jfif encode function until a patch is available. Restrict access to the jfif.c module to minimize the risk of exploitation. Avoid using the jfif encode function in the affected ffjpeg library until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2023-02426

CVE-2021-44957

Affected Products

Ffjpeg

References · 7

• 🔥 https://github.com/rockcarry/ffjpeg/issues/44 · Exploit
• https://bdu.fstec.ru/vul/2023-02426 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44957 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44957 · Security Note
• https://github.com/rockcarry/ffjpeg/pull/45 · Note
• https://github.com/rockcarry/ffjpeg/commit/23dffdfd2507b4de7b9f292ac1a791d68f4fd9a3 · Note
• https://t.me/cibsecurity/37009 · Telegram Post