CVE-2020-22049: Medium severity FFmpeg FFmpeg vulnerability
A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the wtvfileopensector function in wtvdec.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:4.3.7-0+deb11u1Fixed in 7:4.3.8-0+deb11u1Fixed in 7:5.1.6-0+deb12u1Fixed in 7:7.0.2-3Fixed in 7:7.1-3
Event History
Frequently Asked Questions
What is the severity of CVE-2020-22049?
The severity of CVE-2020-22049 is Denial of Service.
How does CVE-2020-22049 affect FFmpeg?
CVE-2020-22049 affects FFmpeg 4.2 due to a memory leak in the wtvfile_open_sector function in wtvdec.c.
Which software versions are affected by CVE-2020-22049?
The affected software versions of CVE-2020-22049 include FFmpeg 3.4.8-0ubuntu0.2, FFmpeg 4.2.4-1ubuntu0.1, FFmpeg 4.3, FFmpeg 2.8.17-0ubuntu0.1+, and FFmpeg 4.1.9-0+deb10u1, 4.1.11-0+deb10u1, 4.3.6-0+deb11u1, 5.1.3-1, and 6.0-7.
How can I fix CVE-2020-22049 on Ubuntu?
To fix CVE-2020-22049 on Ubuntu, update FFmpeg to versions 3.4.8-0ubuntu0.2, 4.2.4-1ubuntu0.1, or 2.8.17-0ubuntu0.1+ depending on the version you are using.
How can I fix CVE-2020-22049 on Debian?
To fix CVE-2020-22049 on Debian, update FFmpeg to versions 4.1.9-0+deb10u1, 4.1.11-0+deb10u1, 4.3.6-0+deb11u1, 5.1.3-1, or 6.0-7 depending on the version you are using.