CVE-2020-22030: Buffer Overflow

Published May 27, 2021

Updated

A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/afafade.c in crossfadesamplesfltp, which might lead to memory corruption and other potential consequences.

Affected Software

3 affected componentsFixes available

debian/ffmpeg

7:4.3.7-0+deb11u17:4.3.8-0+deb11u17:5.1.6-0+deb12u17:7.0.2-37:7.1-3

FFmpeg FFmpeg=4.2

Debian Debian Linux=10.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/ffmpeg to a version that resolves this vulnerability.
Fixed in 7:4.3.7-0+deb11u1Fixed in 7:4.3.8-0+deb11u1Fixed in 7:5.1.6-0+deb12u1Fixed in 7:7.0.2-3Fixed in 7:7.1-3

Event History

May 27, 2021

CVE Published

via MITRE·05:55 PM

Data Sourced

via MITRE·05:55 PM

Description

Data Sourced

via OSV·06:15 PM

DescriptionSeverity

Frequently Asked Questions

What is CVE-2020-22030?

CVE-2020-22030 is a heap-based Buffer Overflow vulnerability in FFmpeg 4.2 at libavfilter/af_afade.c in crossfade_samples_fltp.

What are the potential consequences of CVE-2020-22030?

CVE-2020-22030 might lead to memory corruption and other potential consequences.

Which software versions are affected by CVE-2020-22030?

FFmpeg versions up to 4.3 and 7:4.2.7-0ubuntu0.1 are affected by CVE-2020-22030.

How can I fix CVE-2020-22030?

To fix CVE-2020-22030, update FFmpeg to version 4.3 or the specified remedy versions.

Where can I find more information about CVE-2020-22030?

You can find more information about CVE-2020-22030 at the following references: [CVE-2020-22030](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22030), [FFmpeg Ticket](https://trac.ffmpeg.org/ticket/8276), [Ubuntu Security Notice](https://ubuntu.com/security/notices/USN-5472-1).