CVE-2020-35965: High severity ffmpeg vulnerability
Published Jan 4, 2021
·Updated
decodeframe in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations.
Affected Software
4 affected componentsFixes available
debian/ffmpeg
7:4.3.7-0+deb11u17:4.3.8-0+deb11u17:5.1.6-0+deb12u17:7.0.2-37:7.1-3
FFmpeg FFmpeg>=4.3.1<4.4
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Remediation
Event History
Jan 4, 2021
CVE Published
via MITRE·01:07 AM
Data Sourced
via MITRE·01:07 AM
Description
Jan 11, 2024
Data Sourced
via Launchpad·11:50 PM
Description
Sep 16, 2024
Data Sourced
via Ubuntu·02:29 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-35965.
2
What is the affected software?
The affected software is FFmpeg version 4.3.1.
3
What is the severity of CVE-2020-35965?
The severity of CVE-2020-35965 is not specified in the information provided.
4
How can I fix CVE-2020-35965?
To fix CVE-2020-35965, you should update FFmpeg to version 4.3.2 or later.
5
Where can I find more information about CVE-2020-35965?
You can find more information about CVE-2020-35965 at the following references: [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35965), [OSS-Fuzz Issue](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26532), [FFmpeg Commit](https://github.com/FFmpeg/FFmpeg/commit/3e5959b3457f7f1856d997261e6ac672bba49e8b).