CVE-2021-28429

NameCVE-2021-28429
DescriptionInteger overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesELA-927-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ffmpeg (PTS)stretch (security)7:3.2.18-0+deb9u1vulnerable
stretch (lts), stretch7:3.2.19-0+deb9u4fixed
buster7:4.1.9-0+deb10u1fixed
buster (security)7:4.1.11-0+deb10u1fixed
bullseye7:4.3.6-0+deb11u1fixed
bullseye (security)7:4.3.7-0+deb11u1fixed
bookworm (security), bookworm7:5.1.5-0+deb12u1fixed
trixie7:6.1.1-4fixed
sid7:6.1.1-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ffmpegsourcestretch7:3.2.19-0+deb9u3ELA-927-1
ffmpegsourcebuster7:4.1.8-0+deb10u1
ffmpegsourcebullseye7:4.3.3-0+deb11u1
ffmpegsource(unstable)7:4.4-5

Notes

https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/c94875471e3ba3dc396c6919ff3ec9b14539cd71 (n4.3.3)

Search for package or bug name: Reporting problems