CVE-2020-22019: Buffer Overflow
Buffer Overflow vulnerability in FFmpeg 4.2 at convolutiony10bit in libavfilter/vfvmafmotion.c, which could let a remote malicious user cause a Denial of Service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:4.3.7-0+deb11u1Fixed in 7:4.3.8-0+deb11u1Fixed in 7:5.1.6-0+deb12u1Fixed in 7:7.0.2-3Fixed in 7:7.1-3 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 4.3.3-r0 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 4.4.1-r0 - Upgrade
Upgrade
alpine/ffmpeg4to a version that resolves this vulnerability.Fixed in 4.4.1-r0
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-22019.
What is the title of the vulnerability?
The title of the vulnerability is Buffer Overflow vulnerability in FFmpeg 4.2 at convolution_y_10bit in libavfilter/vf_vmafmotion.c.
What is the description of the vulnerability?
The vulnerability is a buffer overflow vulnerability in FFmpeg 4.2 at convolution_y_10bit in libavfilter/vf_vmafmotion.c, which could let a remote malicious user cause a Denial of Service.
Which software is affected by this vulnerability?
FFmpeg 4.2 is affected by this vulnerability.
How can I fix the vulnerability?
To fix the vulnerability, you should update FFmpeg to version 4.4.1 or higher.