CVE-2020-22051: Medium severity FFmpeg FFmpeg vulnerability

Published Jun 2, 2021

Updated

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the filterframe function in vftile.c.

Affected Software

2 affected componentsFixes available

debian/ffmpeg

7:4.3.7-0+deb11u17:4.3.8-0+deb11u17:5.1.6-0+deb12u17:7.0.2-37:7.1-3

FFmpeg FFmpeg=4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/ffmpeg to a version that resolves this vulnerability.
Fixed in 7:4.3.7-0+deb11u1Fixed in 7:4.3.8-0+deb11u1Fixed in 7:5.1.6-0+deb12u1Fixed in 7:7.0.2-3Fixed in 7:7.1-3

Event History

Jun 2, 2021

CVE Published

via MITRE·04:06 PM

Data Sourced

via MITRE·04:06 PM

Description

Data Sourced

via OSV·05:15 PM

DescriptionSeverity

Frequently Asked Questions

What is the vulnerability ID for this Denial of Service vulnerability in FFmpeg 4.2?

The vulnerability ID for this Denial of Service vulnerability in FFmpeg 4.2 is CVE-2020-22051.

What is the description of the vulnerability?

The vulnerability is a memory leak in the filter_frame function in vf_tile.c.

Which versions of FFmpeg are affected by this vulnerability?

FFmpeg 4.2 and earlier versions are affected by this vulnerability.

How can I fix this vulnerability?

To fix this vulnerability, update FFmpeg to version 4.3 or later.

Where can I find more information about this vulnerability?

You can find more information about this vulnerability at the following references: [CVE-2020-22051](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22051), [FFmpeg Trac Ticket](https://trac.ffmpeg.org/ticket/8313), [FFmpeg Git Commit](http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=673fce6d40d9a594fb7a0ea17d296b7d3d9ea856).