CVE-2020-22041: Medium severity FFmpeg FFmpeg vulnerability

Published Jun 1, 2021

Updated

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avbuffersrcaddframeflags function in buffersrc.

Affected Software

3 affected componentsFixes available

debian/ffmpeg

7:4.3.7-0+deb11u17:4.3.8-0+deb11u17:5.1.6-0+deb12u17:7.0.2-37:7.1-3

FFmpeg FFmpeg=4.2

Debian Debian Linux=9.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/ffmpeg to a version that resolves this vulnerability.
Fixed in 7:4.3.7-0+deb11u1Fixed in 7:4.3.8-0+deb11u1Fixed in 7:5.1.6-0+deb12u1Fixed in 7:7.0.2-3Fixed in 7:7.1-3

Event History

Jun 1, 2021

CVE Published

via MITRE·07:34 PM

Data Sourced

via MITRE·07:34 PM

Description

Data Sourced

via OSV·08:15 PM

DescriptionSeverity

Frequently Asked Questions

What is the vulnerability ID of this Denial of Service vulnerability in FFmpeg 4.2?

The vulnerability ID is CVE-2020-22041.

What is the affected software?

The affected software includes FFmpeg versions 4.2, 4.3, 7:2.8.17-0ubuntu0.1+, 7:3.4.11-0ubuntu0.1, 7:4.2.7-0ubuntu0.1, 7:4.3.6-0+deb11u1, 7:5.1.3-1, 7:6.0-7.

What is the severity of CVE-2020-22041?

The severity of CVE-2020-22041 is not mentioned.

How do I fix the Denial of Service vulnerability in FFmpeg 4.2?

To fix the vulnerability, upgrade FFmpeg to version 4.3.

Where can I find more information about CVE-2020-22041?

You can find more information about CVE-2020-22041 at the following references: [CVE Mitre](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22041), [FFmpeg Trac](https://trac.ffmpeg.org/ticket/8296), [FFmpeg Git Commit](https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3488e0977c671568731afa12b811adce9d4d807f).