Name: CVE-2021-3566: Exposure of Sensitive Information to an Unauthorized Actor
Creator: Rapid7
Published: 2021-08-05T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2021-3566, CWE-200, CVSS 5.5, EPSS 0.0088

Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the `-vcodec copy` option is passed to ffmpeg).

CVSS Details

CVSS 3.1 Base Score: 5.5
CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Debian	—	Upgrade ffmpeg	Aug 16, 2021	Aug 5, 2021
Ffmpeg	—	Upgrade to FFmpeg version 4.4	Aug 16, 2021	Aug 5, 2021
Suse	—	Upgrade libswscale-develUpgrade ffmpegUpgrade libavformat-develUpgrade libavresample3Upgrade libavformat57Upgrade libavdevice57Upgrade libavresample-develUpgrade libavresample3-32bitUpgrade libswscale4-32bitUpgrade libavfilter-develUpgrade libpostproc54-32bitUpgrade libavdevice57-32bitUpgrade ffmpeg-private-develUpgrade libavcodec57Upgrade libswresample2Upgrade libavutil55-32bitUpgrade libswresample-develUpgrade libswresample2-32bitUpgrade libavfilter6-32bitUpgrade libavutil55Upgrade libavcodec57-32bitUpgrade libavutil-develUpgrade libpostproc-develUpgrade libavdevice-develUpgrade libavcodec-develUpgrade libswscale4Upgrade libavfilter6Upgrade libavformat57-32bitUpgrade libpostproc54Upgrade libavresample3-64bit	Oct 27, 2021	Aug 5, 2021
Ubuntu	—	Upgrade libswscale-ffmpeg3 (Ubuntu Pro)Upgrade libavformat-ffmpeg56 (Ubuntu Pro)Upgrade ffmpeg (Ubuntu Pro)Upgrade libavdevice-ffmpeg56 (Ubuntu Pro)Upgrade libavcodec-ffmpeg-extra56 (Ubuntu Pro)Upgrade libavutil-ffmpeg54 (Ubuntu Pro)Upgrade libpostproc-ffmpeg53 (Ubuntu Pro)Upgrade libavcodec-extra (Ubuntu Pro)Upgrade libavfilter-ffmpeg5 (Ubuntu Pro)Upgrade libswresample-ffmpeg1 (Ubuntu Pro)Upgrade libavcodec-ffmpeg56 (Ubuntu Pro)Upgrade libavresample-ffmpeg2 (Ubuntu Pro)	Mar 22, 2023	Aug 5, 2021

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence