Integer Overflow Vulnerability in FFmpeg Package: Denial of Service Risk
Summary
UBUNTU-CVE-2021-38094: Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts. Affects qtwebengine-opensource-src versions 5.9.1+dfsg-4 – 5.9.5+dfsg-0ubuntu2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely-used open-source software suite for handling multimedia data, including audio and video processing. It provides libraries and tools to convert, stream, and manipulate multimedia files. The package is known for its versatility and performance, making it a staple in many applications. However, it is susceptible to vulnerabilities that can be exploited, such as the recent integer overflow issue.
Vulnerability Detail
The vulnerability identified as CVE-2021-38094 is an integer overflow in the function filter_sobel located in libavfilter/vf_convolution.c within FFmpeg version 4.2.1. This flaw allows attackers to exploit the software, potentially leading to a Denial of Service (DoS) or other unspecified impacts. The vulnerability arises from improper handling of input data, which can cause the software to behave unexpectedly or crash, thereby compromising the stability and security of applications relying on FFmpeg.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the affected function filter_sobel until the package is updated. This may involve modifying the application to bypass certain functionalities that rely on this filter.
Conclusion
The integer overflow vulnerability in FFmpeg poses a significant risk to applications using this multimedia processing library. It is crucial for users to update to the latest patched version to mitigate potential security threats. Regular monitoring and updates are essential to maintain software integrity and security.
See every vulnerability recorded for qtwebengine-opensource-src →
FAQ
CVE-2021-38094 is an integer overflow vulnerability in FFmpeg that can lead to Denial of Service attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can cause Denial of Service, leading to application crashes and instability.
Yes, a patched version of FFmpeg is available. Users should update to version 7:4.2.7-0ubuntu0.1+esm3 or later.
The CVSS score for CVE-2021-38094 is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for qtwebengine-opensource-src.
