CVE-2021-38094: Integer Overflow

Q: What is CVE-2021-38094?

CVE-2021-38094 is an Integer Overflow vulnerability in the filter_sobel function in libavfilter/vf_convolution.c in Ffmpeg 4.2.1.

Q: What is the severity of CVE-2021-38094?

The severity of CVE-2021-38094 is high with a CVSS score of 8.8.

Q: What is the affected software for CVE-2021-38094?

The affected software includes Ffmpeg 4.2.1 and Ubuntu 7:4.2.7-0ubuntu0.1+.

Q: How can an attacker exploit CVE-2021-38094?

An attacker can exploit CVE-2021-38094 to cause a Denial of Service or other unspecified impacts.

Q: Are there any references for CVE-2021-38094?

Yes, you can find references for CVE-2021-38094 at the following links: [Reference 1](https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/99f8d32129dd233d4eb2efa44678a0bc44869f23), [Reference 2](https://trac.ffmpeg.org/ticket/8263), [Reference 3](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38094).

Published Sep 20, 2021

Updated

Integer Overflow vulnerability in function filtersobel in libavfilter/vfconvolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.

Affected Software

3 affected componentsFixes available

ubuntu/ffmpeg<7:4.2.7-0ubuntu0.1+

7:4.2.7-0ubuntu0.1+

debian/ffmpeg<=7:4.1.9-0+deb10u1, <=7:4.1.11-0+deb10u1

7:4.3.6-0+deb11u17:5.1.4-0+deb12u17:6.1.1-1

FFmpeg FFmpeg=4.2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/ffmpeg to a version that resolves this vulnerability.
Fixed in 7:4.2.7-0ubuntu0.1+
Upgrade
Upgrade debian/ffmpeg to a version that resolves this vulnerability.
Fixed in 7:4.3.6-0+deb11u1Fixed in 7:5.1.4-0+deb12u1Fixed in 7:6.1.1-1

Event History

Sep 20, 2021

CVE Published

via Ubuntu·12:00 AM

CVE Published

via MITRE·03:20 PM

Data Sourced

via MITRE·03:20 PM

Description

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Jan 11, 2024

Data Sourced

via Launchpad·11:58 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

USN-6449-1

Frequently Asked Questions

What is CVE-2021-38094?

CVE-2021-38094 is an Integer Overflow vulnerability in the filter_sobel function in libavfilter/vf_convolution.c in Ffmpeg 4.2.1.

What is the severity of CVE-2021-38094?

The severity of CVE-2021-38094 is high with a CVSS score of 8.8.

What is the affected software for CVE-2021-38094?

The affected software includes Ffmpeg 4.2.1 and Ubuntu 7:4.2.7-0ubuntu0.1+.

How can an attacker exploit CVE-2021-38094?

An attacker can exploit CVE-2021-38094 to cause a Denial of Service or other unspecified impacts.

Are there any references for CVE-2021-38094?

Yes, you can find references for CVE-2021-38094 at the following links: [Reference 1](https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/99f8d32129dd233d4eb2efa44678a0bc44869f23), [Reference 2](https://trac.ffmpeg.org/ticket/8263), [Reference 3](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38094).

CVE-2021-38094: Integer Overflow

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is CVE-2021-38094?

What is the severity of CVE-2021-38094?

What is the affected software for CVE-2021-38094?

How can an attacker exploit CVE-2021-38094?

Are there any references for CVE-2021-38094?

Company

Resources

Contact