CVE-2021-28429 Integer overflow in n/a
A local attacker can cause a denial of service in FFmpeg by providing a crafted .mov file that triggers an integer overflow.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-28429?
CVE-2021-28429 is a medium-severity vulnerability in Ffmpeg Ffmpeg, published on 11 Aug 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.
Weakness: CWE-190
Which versions are affected by CVE-2021-28429?
It affects 1 product.
Linux distribution packages (8)
ffmpeg SUSE:Linux Enterprise Module for Desktop Applications 15 SP4 | All versions | 3.4.2-150200.11.31.1 |
ffmpeg SUSE:Linux Enterprise Module for Desktop Applications 15 SP5 | All versions | 3.4.2-150200.11.31.1 |
ffmpeg SUSE:Linux Enterprise Module for Package Hub 15 SP4 | All versions | 3.4.2-150200.11.31.1 |
ffmpeg SUSE:Linux Enterprise Module for Package Hub 15 SP5 | All versions | 3.4.2-150200.11.31.1 |
ffmpeg SUSE:Linux Enterprise Workstation Extension 15 SP4 | All versions | 3.4.2-150200.11.31.1 |
ffmpeg SUSE:Linux Enterprise Workstation Extension 15 SP5 | All versions | 3.4.2-150200.11.31.1 |
ffmpeg openSUSE:Leap 15.4 | All versions | 3.4.2-150200.11.31.1 |
ffmpeg openSUSE:Leap 15.5 | All versions | 3.4.2-150200.11.31.1 |
Products include Ffmpeg Ffmpeg.
How do I fix CVE-2021-28429?
Apply the vendor's patch.
Is CVE-2021-28429 being exploited?
There is no known exploitation of CVE-2021-28429 in the wild and no public exploit code.
Other vulnerabilities in Ffmpeg Ffmpeg
Sources
Also known as DEBIAN-CVE-2021-28429, GHSA-9g32-j225-76c5, OESA-2024-1832, OESA-2024-1833, OESA-2024-1834, SUSE-SU-2023:3818-1 and 1 more.