CVE-2020-22035: Buffer Overflow

Published Jun 1, 2021

Updated

A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in getblockrow at libavfilter/vfbm3d.c, which might lead to memory corruption and other potential consequences.

Affected Software

3 affected componentsFixes available

debian/ffmpeg

7:4.3.7-0+deb11u17:4.3.8-0+deb11u17:5.1.6-0+deb12u17:7.0.2-37:7.1-3

FFmpeg FFmpeg=4.2

Debian Debian Linux=10.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/ffmpeg to a version that resolves this vulnerability.
Fixed in 7:4.3.7-0+deb11u1Fixed in 7:4.3.8-0+deb11u1Fixed in 7:5.1.6-0+deb12u1Fixed in 7:7.0.2-3Fixed in 7:7.1-3

Event History

Jun 1, 2021

CVE Published

via MITRE·06:31 PM

Data Sourced

via MITRE·06:31 PM

Description

Data Sourced

via OSV·07:15 PM

DescriptionSeverity

Frequently Asked Questions

What is CVE-2020-22035?

CVE-2020-22035 is a heap-based Buffer Overflow vulnerability in FFmpeg 4.2.

Where does the vulnerability exist in FFmpeg 4.2?

The vulnerability exists in get_block_row at libavfilter/vf_bm3d.c in FFmpeg 4.2.

What are the potential consequences of CVE-2020-22035?

CVE-2020-22035 might lead to memory corruption and other potential consequences.

How can I check if my version of FFmpeg is affected?

You can check if your version of FFmpeg is affected by referring to the affected software section and the provided links.

How do I fix CVE-2020-22035?

To fix CVE-2020-22035, you should update to the recommended version of FFmpeg mentioned in the affected software section.