Remote Code Execution (RCE)

2021-09-0316:57:00

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

65.6%

JSON

ffmpeg is vulnerable to remote code execution. The vulnerability exists due to a heap-use-after-free in the av_freep function in libavutil/mem.c which allows an attacker to inject and execute malicious codes.

CPENameOperatorVersion
ffmpeg:sideq7:4.3.1-5
ffmpeg:bullseyeeq7:4.3.1-5
ffmpeg:bullseyeeq7:4.3.2-0+deb11u2
ffmpeg:focaleq7:4.2.4-1ubuntu0.1
ffmpeg:focaleq7:4.2.2-1ubuntu1
ffmpeg:bioniceq7:3.4.8-0ubuntu0.2
ffmpeg:bioniceq7:3.4.2-2
ffmpeg:bustereq7:4.1.6-1~deb10u1
ffmpeg:sideq7:4.3.1-5
ffmpeg:bullseyeeq7:4.3.1-5

Name	Operator	Version
ffmpeg:sid	eq	7:4.3.1-5
ffmpeg:bullseye	eq	7:4.3.1-5
ffmpeg:bullseye	eq	7:4.3.2-0+deb11u2
ffmpeg:focal	eq	7:4.2.4-1ubuntu0.1
ffmpeg:focal	eq	7:4.2.2-1ubuntu1
ffmpeg:bionic	eq	7:3.4.8-0ubuntu0.2
ffmpeg:bionic	eq	7:3.4.2-2
ffmpeg:buster	eq	7:4.1.6-1~deb10u1
ffmpeg:sid	eq	7:4.3.1-5
ffmpeg:bullseye	eq	7:4.3.1-5