CVE-2020-22024: Buffer Overflow
Buffer Overflow vulnerability in FFmpeg 4.2 at the lagfunframe16 function in libavfilter/vflagfun.c, which could let a remote malicious user cause Denial of Service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:4.3.7-0+deb11u1Fixed in 7:4.3.8-0+deb11u1Fixed in 7:5.1.6-0+deb12u1Fixed in 7:7.0.2-3Fixed in 7:7.1-3
Event History
Frequently Asked Questions
What is CVE-2020-22024?
CVE-2020-22024 is a buffer overflow vulnerability in FFmpeg 4.2 at the lagfun_frame16 function in libavfilter/vf_lagfun.c.
What is the impact of CVE-2020-22024?
CVE-2020-22024 could allow a remote malicious user to cause a Denial of Service.
Which software versions are affected by CVE-2020-22024?
FFmpeg 4.2 versions up to and including 7:4.2.7-0ubuntu0.1+ on Ubuntu, and various versions on Debian including 7:4.1.9-0+deb10u1, 7:4.1.11-0+deb10u1, 7:4.3.6-0+deb11u1, 7:5.1.3-1, and 7:6.0-7.
How can I fix CVE-2020-22024 on Ubuntu?
To fix CVE-2020-22024 on Ubuntu, update the ffmpeg package to version 7:4.2.7-0ubuntu0.1+ or later.
How can I fix CVE-2020-22024 on Debian?
To fix CVE-2020-22024 on Debian, update the ffmpeg package to one of the following versions: 7:4.1.9-0+deb10u1, 7:4.1.11-0+deb10u1, 7:4.3.6-0+deb11u1, 7:5.1.3-1, or 7:6.0-7.