CVE-2020-20446: Divide by Zero
FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious user to cause a Denial of Service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:4.3.7-0+deb11u1Fixed in 7:4.3.8-0+deb11u1Fixed in 7:5.1.6-0+deb12u1Fixed in 7:7.0.2-3Fixed in 7:7.1-3 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 4.3.3-r0 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 4.4.1-r0 - Upgrade
Upgrade
alpine/ffmpeg4to a version that resolves this vulnerability.Fixed in 4.4.1-r0
Event History
Frequently Asked Questions
What is CVE-2020-20446?
CVE-2020-20446 is a vulnerability in FFmpeg 4.2 that allows a remote malicious user to cause a Denial of Service.
How does CVE-2020-20446 affect FFmpeg?
CVE-2020-20446 affects FFmpeg 4.2 via the libavcodec/aacpsy.c file.
Which versions of FFmpeg are affected by CVE-2020-20446?
FFmpeg versions 4.2, 4.4.2-0ubuntu0.21.10.1, 3.4.11-0ubuntu0.1, and 4.2.7-0ubuntu0.1 are affected.
How can the vulnerability in FFmpeg be fixed?
To fix the vulnerability in FFmpeg, update to version 7:4.4.2-0ubuntu0.21.10.1, 7:3.4.11-0ubuntu0.1, or 7:4.2.7-0ubuntu0.1.
Where can I find more information about CVE-2020-20446?
You can find more information about CVE-2020-20446 on the CVE Mitre website, the FFmpeg ticket #7995, and the Ubuntu Security Notice USN-5472-1.