PT-2021-4535 · FFmpeg+5 · Ffmpeg+5

CVE-2020-21041 · Publicado 2019-02-21 · Atualizado 2026-02-06

Positive Technologies (AI Summary) · Pt

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Nome do software vulnerável e versões afetadas

FFmpeg versão 4.1

Descrição

O problema está relacionado a um estouro de buffer no componente apng do inverse blend da biblioteca FFmpeg, o que poderia permitir que um invasor remoto causasse uma negação de serviço.

Recomendações

Para a versão 4.1 do FFmpeg, considere desativar a função apng do inverse blend em libavcodec/pngenc.c para impedir a exploração até que um patch esteja disponível.

Exploit

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-120

Identificadores relacionados

ALT-PU-2019-1275

ALT-PU-2023-4100

ALT-PU-2023-4117

BDU:2021-05190

CLEANSTART-2026-EZ98723

CLEANSTART-2026-PS82605

CLEANSTART-2026-XE32069

CVE-2020-21041

DLA-2742-1

DSA-4990-1

MGASA-2021-0495

OPENSUSE-SU-2021:2322-1

OPENSUSE-SU-2021_2322-1

SUSE-SU-2021:2322-1

SUSE-SU-2021:2929-1

USN-5167-1

USN-5472-1

Produtos afetados

Alt Linux

Astra Linux

Ffmpeg

Linuxmint

Suse

Ubuntu

Referências · 269

• 🔥 https://trac.ffmpeg.org/ticket/7989 · Exploit
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EZ98723.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-XE32069.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EZ98723 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-XE32069 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PS82605 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PS82605.json · Nota
• https://osv.dev/vulnerability/CVE-2018-14394 · Nota
• https://osv.dev/vulnerability/DLA-2742-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2020-22037 · Nota
• https://bugzilla.suse.com/1186849 · Nota
• https://ubuntu.com/security/CVE-2021-38114 · Aviso do Fabricante
• https://bugzilla.suse.com/1172640 · Nota
• https://osv.dev/vulnerability/CVE-2018-1999015 · Nota
• https://suse.com/security/cve/CVE-2020-22017 · Nota