critical
CVE-2021-38171
adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not ...
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Julia9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Julia. Rated lower by Ubuntu (medium).
Description
adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step because the second argument to init_get_bits can be crafted.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | FFMPEG_jll | 4.4.2+0 |
| alpine 3.13 | ffmpeg | 4.3.3-r0 |
| alpine 3.14 | ffmpeg | 4.4.1-r0 |
| alpine 3.15 | ffmpeg | 4.4.1-r0 |
| alpine 3.16 | ffmpeg, ffmpeg4 | 4.4.1-r0 |
| alpine 3.17 | ffmpeg, ffmpeg4 | 4.4.1-r0 |
| alpine 3.18 | ffmpeg, ffmpeg4 | 4.4.1-r0 |
| alpine 3.19 | ffmpeg, ffmpeg4 | 4.4.1-r0 |
| alpine 3.20 | ffmpeg, ffmpeg4 | 4.4.1-r0 |
| alpine 3.21 | ffmpeg, ffmpeg4 | 4.4.1-r0 |
| alpine 3.22 | ffmpeg, ffmpeg4 | 4.4.1-r0 |
| alpine 3.23 | ffmpeg | 4.4.1-r0 |
Show all 42 entries from 32 sources
| Source | Package | Fixed in |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | FFMPEG_jll | 4.4.2+0 |
| alpine 3.13 | ffmpeg | 4.3.3-r0 |
| alpine 3.14 | ffmpeg | 4.4.1-r0 |
| alpine 3.15 | ffmpeg | 4.4.1-r0 |
| alpine 3.16 | ffmpeg | 4.4.1-r0 |
| alpine 3.16 | ffmpeg4 | 4.4.1-r0 |
| alpine 3.17 | ffmpeg | 4.4.1-r0 |
| alpine 3.17 | ffmpeg4 | 4.4.1-r0 |
| alpine 3.18 | ffmpeg | 4.4.1-r0 |
| alpine 3.18 | ffmpeg4 | 4.4.1-r0 |
| alpine 3.19 | ffmpeg | 4.4.1-r0 |
| alpine 3.19 | ffmpeg4 | 4.4.1-r0 |
| alpine 3.20 | ffmpeg | 4.4.1-r0 |
| alpine 3.20 | ffmpeg4 | 4.4.1-r0 |
| alpine 3.21 | ffmpeg | 4.4.1-r0 |
| alpine 3.21 | ffmpeg4 | 4.4.1-r0 |
| alpine 3.22 | ffmpeg | 4.4.1-r0 |
| alpine 3.22 | ffmpeg4 | 4.4.1-r0 |
| alpine 3.23 | ffmpeg | 4.4.1-r0 |
| alpine 3.24 | ffmpeg | 4.4.1-r0 |
| alpine edge | ffmpeg | 4.4.1-r0 |
| debian 10 | ffmpeg | 7:4.1.8-0+deb10u1 |
| debian 11 | ffmpeg | 7:4.3.3-0+deb11u1 |
| debian 12 | ffmpeg | 7:4.4.1-1 |
| debian 13 | ffmpeg | 7:4.4.1-1 |
| debian 14 | ffmpeg | 7:4.4.1-1 |
| debian 9 | ffmpeg | 7:3.2.16-1+deb9u1 |
| echo | ffmpeg | 7:4.4.1-1 |
| rapidfort ubuntu 20.04 | ffmpeg | 7:4.4.2-0ubuntu0.21.10.1 |
| rapidfort ubuntu 20.04 | rf-ffmpeg | 7:4.4.2-0ubuntu0.21.10.1 |
| rapidfort ubuntu 22.04 | ffmpeg | 7:4.4.2-0ubuntu0.21.10.1 |
| rapidfort ubuntu 22.04 | rf-ffmpeg | 7:4.4.2-0ubuntu0.21.10.1 |
| rapidfort ubuntu 24.04 | ffmpeg | 7:4.4.2-0ubuntu0.21.10.1 |
| rapidfort ubuntu 24.04 | rf-ffmpeg | 7:4.4.2-0ubuntu0.21.10.1 |
| root.io debian 11 | rootio-ffmpeg | 7:4.3.3-0+deb11u1 |
| root.io debian 12 | rootio-ffmpeg | 7:4.4.1-1 |
| ubuntu 16.04-ESM | ffmpeg | 7:2.8.17-0ubuntu0.1+esm4 |
| ubuntu 18.04 | ffmpeg | 7:3.4.11-0ubuntu0.1 |
| ubuntu 18.04-ESM | ffmpeg | 7:3.4.11-0ubuntu0.1 |
| ubuntu 20.04 | ffmpeg | 7:4.2.7-0ubuntu0.1 |
| ubuntu 20.04-ESM | ffmpeg | 7:4.2.7-0ubuntu0.1 |
| ubuntu 21.10 | ffmpeg | 7:4.4.2-0ubuntu0.21.10.1 |
References
- https://github.com/FFmpeg/FFmpeg/commit/9ffa49496d1aae4cbbb387aac28a9e061a6ab0a6
- https://lists.debian.org/debian-lts-announce/2021/11/msg00012.html
- https://patchwork.ffmpeg.org/project/ffmpeg/patch/AS8P193MB12542A86E22F8207EC971930B6F19@AS8P193MB1254.EURP193.PROD.OUTLOOK.COM/
- https://security.gentoo.org/glsa/202312-14
- https://ubuntu.com/security/notices/USN-5167-1
- https://ubuntu.com/security/notices/USN-5472-1
- https://www.cve.org/CVERecord?id=CVE-2021-38171
- https://www.debian.org/security/2021/dsa-4990