CVE-2020-35965: High severity FFmpeg FFmpeg vulnerability
decodeframe in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ffmpegto a version that resolves this vulnerability.Fixed in 7:4.3.7-0+deb11u1Fixed in 7:4.3.8-0+deb11u1Fixed in 7:5.1.6-0+deb12u1Fixed in 7:7.0.2-3Fixed in 7:7.1-3 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 4.3.1-r4 - Upgrade
Upgrade
alpine/ffmpegto a version that resolves this vulnerability.Fixed in 4.3.2-r0 - Upgrade
Upgrade
alpine/ffmpeg4to a version that resolves this vulnerability.Fixed in 4.3.2-r0
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-35965.
What is the affected software?
The affected software is FFmpeg version 4.3.1.
What is the severity of CVE-2020-35965?
The severity of CVE-2020-35965 is not specified in the information provided.
How can I fix CVE-2020-35965?
To fix CVE-2020-35965, you should update FFmpeg to version 4.3.2 or later.
Where can I find more information about CVE-2020-35965?
You can find more information about CVE-2020-35965 at the following references: [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35965), [OSS-Fuzz Issue](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26532), [FFmpeg Commit](https://github.com/FFmpeg/FFmpeg/commit/3e5959b3457f7f1856d997261e6ac672bba49e8b).