CVE-2021-38093: Integer Overflow

Q: What is CVE-2021-38093?

CVE-2021-38093 is an Integer Overflow vulnerability in the filter_robert function in libavfilter/vf_convolution.c in Ffmpeg. It allows attackers to cause a Denial of Service or other unspecified impacts.

Q: How severe is CVE-2021-38093?

CVE-2021-38093 has a severity score of 8.8 (high).

Q: Which software versions are affected by CVE-2021-38093?

Ffmpeg version 4.2.1 is affected by CVE-2021-38093.

Q: How can CVE-2021-38093 be fixed?

To fix CVE-2021-38093, it is recommended to update Ffmpeg to version 4.2.7-0ubuntu0.1+ (for Ubuntu) or 7:4.3.6-0+deb11u1, 7:5.1.3-1, or 7:6.0-7 (for Debian).

Q: Where can I find more information about CVE-2021-38093?

More information about CVE-2021-38093 can be found at the following references: [Git commit](https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/99f8d32129dd233d4eb2efa44678a0bc44869f23), [FFmpeg ticket](https://trac.ffmpeg.org/ticket/8263), [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38093).

Published Sep 20, 2021

Updated

Integer Overflow vulnerability in function filterrobert in libavfilter/vfconvolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.

Affected Software

3 affected componentsFixes available

ubuntu/ffmpeg<7:4.2.7-0ubuntu0.1+

7:4.2.7-0ubuntu0.1+

debian/ffmpeg<=7:4.1.9-0+deb10u1, <=7:4.1.11-0+deb10u1

7:4.3.6-0+deb11u17:5.1.4-0+deb12u17:6.1.1-1

FFmpeg FFmpeg=4.2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/ffmpeg to a version that resolves this vulnerability.
Fixed in 7:4.2.7-0ubuntu0.1+
Upgrade
Upgrade debian/ffmpeg to a version that resolves this vulnerability.
Fixed in 7:4.3.6-0+deb11u1Fixed in 7:5.1.4-0+deb12u1Fixed in 7:6.1.1-1

Event History

Sep 20, 2021

CVE Published

via Ubuntu·12:00 AM

CVE Published

via MITRE·03:20 PM

Data Sourced

via MITRE·03:20 PM

Description

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Jan 11, 2024

Data Sourced

via Launchpad·11:58 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

USN-6449-1

Frequently Asked Questions

What is CVE-2021-38093?

CVE-2021-38093 is an Integer Overflow vulnerability in the filter_robert function in libavfilter/vf_convolution.c in Ffmpeg. It allows attackers to cause a Denial of Service or other unspecified impacts.

How severe is CVE-2021-38093?

CVE-2021-38093 has a severity score of 8.8 (high).

Which software versions are affected by CVE-2021-38093?

Ffmpeg version 4.2.1 is affected by CVE-2021-38093.

How can CVE-2021-38093 be fixed?

To fix CVE-2021-38093, it is recommended to update Ffmpeg to version 4.2.7-0ubuntu0.1+ (for Ubuntu) or 7:4.3.6-0+deb11u1, 7:5.1.3-1, or 7:6.0-7 (for Debian).

Where can I find more information about CVE-2021-38093?

More information about CVE-2021-38093 can be found at the following references: [Git commit](https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/99f8d32129dd233d4eb2efa44678a0bc44869f23), [FFmpeg ticket](https://trac.ffmpeg.org/ticket/8263), [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38093).

CVE-2021-38093: Integer Overflow

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is CVE-2021-38093?

How severe is CVE-2021-38093?

Which software versions are affected by CVE-2021-38093?

How can CVE-2021-38093 be fixed?

Where can I find more information about CVE-2021-38093?

Company

Resources

Contact