CVE-2020-22040: Medium severity FFmpeg FFmpeg vulnerability

Published Jun 1, 2021

Updated

A Denial of Service vulnerability exists in FFmpeg 4.2 idue to a memory leak in the vframealloc function in frame.c.

Affected Software

2 affected componentsFixes available

debian/ffmpeg

7:4.3.7-0+deb11u17:4.3.8-0+deb11u17:5.1.6-0+deb12u17:7.0.2-37:7.1-3

FFmpeg FFmpeg=4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/ffmpeg to a version that resolves this vulnerability.
Fixed in 7:4.3.7-0+deb11u1Fixed in 7:4.3.8-0+deb11u1Fixed in 7:5.1.6-0+deb12u1Fixed in 7:7.0.2-3Fixed in 7:7.1-3

Event History

Jun 1, 2021

CVE Published

via MITRE·07:18 PM

Data Sourced

via MITRE·07:18 PM

Description

Data Sourced

via OSV·08:15 PM

DescriptionSeverity

Frequently Asked Questions

What is CVE-2020-22040?

CVE-2020-22040 is a Denial of Service vulnerability in FFmpeg 4.2 due to a memory leak in the v_frame_alloc function in frame.c.

How can CVE-2020-22040 affect me?

CVE-2020-22040 can lead to a Denial of Service attack, causing the affected FFmpeg version to crash or become unresponsive.

Which software versions are affected by CVE-2020-22040?

FFmpeg versions 4.3 (up to exclusive), 7:2.8.17-0ubuntu0.1+ (up to exclusive), 7:3.4.11-0ubuntu0.1+ (up to exclusive), 7:4.2.7-0ubuntu0.1+ (up to exclusive), 7:4.3.6-0+deb11u1, 7:5.1.3-1, and 7:6.0-7 are affected by CVE-2020-22040.

How severe is CVE-2020-22040?

CVE-2020-22040 is a Denial of Service vulnerability and can be considered a moderate to high severity depending on the impact to the affected system.

Is there a fix available for CVE-2020-22040?

Yes, upgrading to FFmpeg version 4.3 or later will fix CVE-2020-22040.