CVE-2020-22035: Buffer Overflow
First published: Tue Jun 01 2021(Updated: )
A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in get_block_row at libavfilter/vf_bm3d.c, which might lead to memory corruption and other potential consequences.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/ffmpeg | 7:4.3.7-0+deb11u1 7:4.3.8-0+deb11u1 7:5.1.6-0+deb12u1 7:7.0.2-3 7:7.1-3 | |
| FFmpeg | =4.2 | |
| Debian Debian Linux | =10.0 | |
| Debian | =10.0 |
Remedy
https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=0749082eb93ea02fa4b770da86597450cec84054
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://trac.ffmpeg.org/ticket/8262
- https://www.debian.org/security/2021/dsa-4990
- https://launchpad.net/bugs/cve/CVE-2020-22035
- https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=0749082eb93ea02fa4b770da86597450cec84054
- https://security-tracker.debian.org/tracker/CVE-2020-22035
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22035
- https://nvd.nist.gov/vuln/detail/CVE-2020-22035
- https://ubuntu.com/security/CVE-2020-22035
Frequently Asked Questions
What is CVE-2020-22035?
CVE-2020-22035 is a heap-based Buffer Overflow vulnerability in FFmpeg 4.2.
Where does the vulnerability exist in FFmpeg 4.2?
The vulnerability exists in get_block_row at libavfilter/vf_bm3d.c in FFmpeg 4.2.
What are the potential consequences of CVE-2020-22035?
CVE-2020-22035 might lead to memory corruption and other potential consequences.
How can I check if my version of FFmpeg is affected?
You can check if your version of FFmpeg is affected by referring to the affected software section and the provided links.
How do I fix CVE-2020-22035?
To fix CVE-2020-22035, you should update to the recommended version of FFmpeg mentioned in the affected software section.
- agent/type
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/remedy
- agent/weakness
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/first-publish-date
- agent/description
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/trending
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-cve
- source/NVD
- package-manager/debian
- vendor/ffmpeg
- canonical/ffmpeg
- version/ffmpeg/4.2
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- canonical/debian
- version/debian/10.0