CVE-2021-38092: Integer Overflow

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2021-38092.

Q: What component of Ffmpeg is affected by this vulnerability?

The function filter_prewitt in libavfilter/vf_convolution.c is affected by this vulnerability.

Q: What is the severity of CVE-2021-38092?

The severity of CVE-2021-38092 is high, with a CVSS score of 8.8.

Q: What are the possible impacts of this vulnerability?

This vulnerability can cause a Denial of Service or other unspecified impacts.

Q: How can I fix this vulnerability in Ffmpeg 4.2.1?

To fix this vulnerability, upgrade Ffmpeg to version 7:4.2.7-0ubuntu0.1+ or higher.

Q: Are there any additional references for CVE-2021-38092?

Yes, you can refer to these sources for more information: [Git Commit](https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/99f8d32129dd233d4eb2efa44678a0bc44869f23), [FFmpeg Ticket](https://trac.ffmpeg.org/ticket/8263), and [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38092).

Published Sep 20, 2021

Updated

Integer Overflow vulnerability in function filterprewitt in libavfilter/vfconvolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.

Affected Software

3 affected componentsFixes available

debian/ffmpeg<=7:4.1.9-0+deb10u1, <=7:4.1.11-0+deb10u1

7:4.3.6-0+deb11u17:5.1.4-0+deb12u17:6.1.1-1

ubuntu/ffmpeg<7:4.2.7-0ubuntu0.1+

7:4.2.7-0ubuntu0.1+

FFmpeg FFmpeg=4.2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/ffmpeg to a version that resolves this vulnerability.
Fixed in 7:4.3.6-0+deb11u1Fixed in 7:5.1.4-0+deb12u1Fixed in 7:6.1.1-1
Upgrade
Upgrade ubuntu/ffmpeg to a version that resolves this vulnerability.
Fixed in 7:4.2.7-0ubuntu0.1+

Event History

Sep 20, 2021

CVE Published

via Ubuntu·12:00 AM

CVE Published

via MITRE·03:20 PM

Data Sourced

via MITRE·03:20 PM

Description

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Jan 11, 2024

Data Sourced

via Launchpad·11:58 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

USN-6449-1

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2021-38092.

What component of Ffmpeg is affected by this vulnerability?

The function filter_prewitt in libavfilter/vf_convolution.c is affected by this vulnerability.

What is the severity of CVE-2021-38092?

The severity of CVE-2021-38092 is high, with a CVSS score of 8.8.

What are the possible impacts of this vulnerability?

This vulnerability can cause a Denial of Service or other unspecified impacts.

How can I fix this vulnerability in Ffmpeg 4.2.1?

To fix this vulnerability, upgrade Ffmpeg to version 7:4.2.7-0ubuntu0.1+ or higher.

Are there any additional references for CVE-2021-38092?

Yes, you can refer to these sources for more information: [Git Commit](https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/99f8d32129dd233d4eb2efa44678a0bc44869f23), [FFmpeg Ticket](https://trac.ffmpeg.org/ticket/8263), and [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38092).

CVE-2021-38092: Integer Overflow

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is the vulnerability ID for this issue?

What component of Ffmpeg is affected by this vulnerability?

What is the severity of CVE-2021-38092?

What are the possible impacts of this vulnerability?

How can I fix this vulnerability in Ffmpeg 4.2.1?

Are there any additional references for CVE-2021-38092?

Company

Resources

Contact