CVE-2021-3566

Description

Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitimate "ffconcat" file that references an image, followed by a file the triggers the tty demuxer, the contents of the second file will be copied into the output file verbatim (as long as the `-vcodec copy` option is passed to ffmpeg).

How to fix CVE-2021-3566

To remediate CVE-2021-3566, upgrade the affected package to a fixed version below.

• —upgrade to 7:4.3-2 or later

Is CVE-2021-3566 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 7:4.3-2

CVSS scores

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-3566