CVE-2020-22020: Buffer Overflow
Buffer Overflow vulnerability in FFmpeg 4.2 in the builddiffmap function in libavfilter/vffieldmatch.c, which could let a remote malicious user cause a Denial of Service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:4.3.7-0+deb11u1Fixed in 7:4.3.8-0+deb11u1Fixed in 7:5.1.6-0+deb12u1Fixed in 7:7.0.2-3Fixed in 7:7.1-3
Event History
Frequently Asked Questions
What is CVE-2020-22020?
CVE-2020-22020 is a buffer overflow vulnerability in FFmpeg 4.2.
How can a remote malicious user exploit CVE-2020-22020?
A remote malicious user can exploit CVE-2020-22020 to cause a Denial of Service.
Which versions of FFmpeg are affected by CVE-2020-22020?
FFmpeg versions 3.4.11 to 4.2.7 are affected by CVE-2020-22020.
How can I fix CVE-2020-22020 in Ubuntu?
To fix CVE-2020-22020 in Ubuntu, update FFmpeg to version 3.4.11-0ubuntu0.1 (for Bionic) or 4.2.7-0ubuntu0.1 (for Focal), depending on your distribution.
How can I fix CVE-2020-22020 in Debian?
To fix CVE-2020-22020 in Debian, update FFmpeg to version 7:4.1.9-0+deb10u1, 7:4.1.11-0+deb10u1, 7:4.3.6-0+deb11u1, 7:5.1.3-1, or 7:6.0-7, depending on your distribution.