CVE-2021-28429

Name	CVE-2021-28429
Description	Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ffmpeg (PTS)	bookworm, bookworm (security)	7:5.1.9-0+deb12u1	fixed
	trixie (security), trixie	7:7.1.5-0+deb13u1	fixed
	forky, sid	7:8.1.2-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
ffmpeg	source	buster	7:4.1.8-0+deb10u1
ffmpeg	source	bullseye	7:4.3.3-0+deb11u1
ffmpeg	source	(unstable)	7:4.4-5

https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/c94875471e3ba3dc396c6919ff3ec9b14539cd71 (n4.3.3)