QwikSec

Security Database

CVE

CWE

Training

CVE-2021-3566

Published: Aug 5, 2021

Modified: Aug 3, 2024

PUBLISHED

Description

Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the `-vcodec copy` option is passed to ffmpeg).

Vendor	Product	Versions
n/a	ffmpeg	affected `ffmpeg 4.3`

Weaknesses (CWE)

References

https://github.com/FFmpeg/FFmpeg/commit/3bce9e9b3ea35c54bacccc793d7da99ea5157532#diff-74f6b92a0541378ad15de9c29c0a2b0c69881ad9ffc71abe568b88b535e00a7f

x_refsource_MISC

[debian-lts-announce] 20210815 [SECURITY] [DLA 2742-1] ffmpeg security update

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.