CVE-2020-20446: Divide by Zero
Published May 25, 2021
·Updated
FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious user to cause a Denial of Service.
Affected Software
5 affected componentsFixes available
debian/ffmpeg
7:4.3.7-0+deb11u17:4.3.8-0+deb11u17:5.1.6-0+deb12u17:7.0.2-37:7.1-3
FFmpeg FFmpeg=4.2
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Remediation
Event History
May 25, 2021
CVE Published
via MITRE·05:40 PM
Data Sourced
via MITRE·05:40 PM
Description
Jan 11, 2024
Data Sourced
via Launchpad·11:44 PM
Description
Sep 16, 2024
Data Sourced
via Ubuntu·02:24 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is CVE-2020-20446?
CVE-2020-20446 is a vulnerability in FFmpeg 4.2 that allows a remote malicious user to cause a Denial of Service.
2
How does CVE-2020-20446 affect FFmpeg?
CVE-2020-20446 affects FFmpeg 4.2 via the libavcodec/aacpsy.c file.
3
Which versions of FFmpeg are affected by CVE-2020-20446?
FFmpeg versions 4.2, 4.4.2-0ubuntu0.21.10.1, 3.4.11-0ubuntu0.1, and 4.2.7-0ubuntu0.1 are affected.
4
How can the vulnerability in FFmpeg be fixed?
To fix the vulnerability in FFmpeg, update to version 7:4.4.2-0ubuntu0.21.10.1, 7:3.4.11-0ubuntu0.1, or 7:4.2.7-0ubuntu0.1.
5
Where can I find more information about CVE-2020-20446?
You can find more information about CVE-2020-20446 on the CVE Mitre website, the FFmpeg ticket #7995, and the Ubuntu Security Notice USN-5472-1.