CVE-2020-20453: Divide by Zero
FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aaccoder, which allows a remote malicious user to cause a Denial of Service
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:4.3.7-0+deb11u1Fixed in 7:4.3.8-0+deb11u1Fixed in 7:5.1.6-0+deb12u1Fixed in 7:7.0.2-3Fixed in 7:7.1-3 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 4.3.3-r0 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 4.4.1-r0 - Upgrade
Upgrade
alpine/ffmpeg4to a version that resolves this vulnerability.Fixed in 4.4.1-r0
Event History
Frequently Asked Questions
What is CVE-2020-20453?
CVE-2020-20453 is a Divide By Zero vulnerability in FFmpeg 4.2 via libavcodec/aaccoder.
How does CVE-2020-20453 impact FFmpeg?
CVE-2020-20453 allows a remote malicious user to cause a Denial of Service (DoS) in FFmpeg 4.2.
Which versions of FFmpeg are affected by CVE-2020-20453?
FFmpeg versions 7:4.4.2-0ubuntu0.21.10.1, 7:3.4.11-0ubuntu0.1, 7:4.2.7-0ubuntu0.1, 4.4.1, 7:2.8.17-0ubuntu0.1+, 7:4.1.9-0+deb10u1, 7:4.1.11-0+deb10u1, 7:4.3.6-0+deb11u1, 7:5.1.3-1, and 7:6.0-7 are affected by CVE-2020-20453.
What is the severity of CVE-2020-20453?
The severity of CVE-2020-20453 is not specified.
How can I fix CVE-2020-20453 in FFmpeg?
To fix CVE-2020-20453 in FFmpeg, update to the recommended version specified in the corresponding security notice from your operating system's vendor.