Vulnerability Details : CVE-2021-38291
FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c.
Products affected by CVE-2021-38291
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
- cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-38291
0.94%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 83 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-38291
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2021-38291
-
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-38291
-
https://www.debian.org/security/2021/dsa-4998
Debian -- Security Information -- DSA-4998-1 ffmpegThird Party Advisory
-
https://trac.ffmpeg.org/ticket/9312
#9312 (assertion failed in av_rescale_delta) – FFmpegExploit;Patch;Vendor Advisory
-
https://lists.debian.org/debian-lts-announce/2021/11/msg00012.html
[SECURITY] [DLA 2818-1] ffmpeg security updateMailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/202312-14
FFmpeg: Multiple Vulnerabilities (GLSA 202312-14) — Gentoo security
-
https://www.debian.org/security/2021/dsa-4990
Debian -- Security Information -- DSA-4990-1 ffmpegThird Party Advisory
Jump to