Integer Overflow Vulnerability in Ffmpeg Package: CVE-2021-38092
Summary
UBUNTU-CVE-2021-38092: Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Affects qtwebengine-opensource-src versions 5.9.1+dfsg-4 – 5.9.5+dfsg-0ubuntu2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ffmpeg is a widely-used open-source multimedia framework that enables users to record, convert, and stream audio and video. It supports various formats and codecs, making it a crucial tool for developers and media professionals. The specific version affected by this vulnerability is 4.2.1, which contains a flaw in the libavfilter component, particularly in the filter_prewitt function. This vulnerability can lead to severe security risks if not addressed promptly.
Vulnerability Detail
The vulnerability identified as CVE-2021-38092 is an Integer Overflow issue found in the filter_prewitt function within the libavfilter module of Ffmpeg version 4.2.1. This flaw allows attackers to exploit the overflow condition, potentially leading to a Denial of Service (DoS) or other unspecified impacts. The vulnerability has a CVSS score of 8.8, indicating a high severity level, which underscores the urgency of addressing this issue to prevent exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the specific functionality affected by the filter_prewitt function until the package is updated. This may involve disabling certain features in applications that rely on Ffmpeg for processing video filters.
Conclusion
The Integer Overflow vulnerability in the Ffmpeg package (CVE-2021-38092) poses significant risks, including potential Denial of Service attacks. Users are strongly advised to update to the latest version of Ffmpeg to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for qtwebengine-opensource-src →
FAQ
CVE-2021-38092 is an Integer Overflow vulnerability in the Ffmpeg package that can lead to Denial of Service or other impacts.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2021-38092 is 8.8, indicating a high severity level.
You can update the Ffmpeg package by running 'sudo apt update && sudo apt install ffmpeg' in your terminal.
If you cannot update immediately, consider disabling the affected functionalities that utilize the filter_prewitt function until a patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for qtwebengine-opensource-src.
