CVE-2020-13904: Use After Free
FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parseplaylist in libavformat/hls.c frees a pointer, and later that pointer is accessed in avprobeinputformat3 in libavformat/format.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:4.3.7-0+deb11u1Fixed in 7:4.3.9-0+deb11u2Fixed in 7:5.1.8-0+deb12u1Fixed in 7:7.1.3-0+deb13u1Fixed in 7:8.0.1-3Fixed in 7:8.1-3 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 4.1.6-r0 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 4.2.4-r0 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 4.3-r0 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 4.0.6-r0 - Upgrade
Upgrade
alpine/ffmpeg4to a version that resolves this vulnerability.Fixed in 4.3-r0
Event History
Frequently Asked Questions
What is CVE-2020-13904?
CVE-2020-13904 is a vulnerability in FFmpeg 2.8 and 4.2.3 that allows for a use-after-free attack via a crafted EXTINF duration in an m3u8 file.
How severe is CVE-2020-13904?
CVE-2020-13904 has a severity score of 5.5, which is considered medium.
Which software versions are affected by CVE-2020-13904?
FFmpeg versions 2.8 and 4.2.3 are affected by CVE-2020-13904.
How can I fix CVE-2020-13904?
To fix CVE-2020-13904, update to FFmpeg version 4.2.4-1ubuntu0.1 or later.
Where can I find more information about CVE-2020-13904?
More information about CVE-2020-13904 can be found at the following references: [Link 1](https://patchwork.ffmpeg.org/project/ffmpeg/patch/20200529033905.41926-1-lq@chinaffmpeg.org/), [Link 2](https://trac.ffmpeg.org/ticket/8673), [Link 3](https://www.debian.org/security/2020/dsa-4722).