PT-2019-6177 · FFmpeg+4 · Ffmpeg+4

Published 2019-10-13 · Updated 2023-01-02 · CVE-2020-20892

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ffmpeg version 4.2.1

Description The issue is related to a division by zero in the filter frame function of the libavfilter/vf lenscorrection.c component. This allows attackers to cause a Denial of Service or potentially gain access to confidential data, disrupt its integrity, and cause unspecified impacts. The vulnerability can be exploited by a remote attacker.

Recommendations For Ffmpeg version 4.2.1, consider disabling the filter frame function in libavfilter/vf lenscorrection.c as a temporary workaround to minimize the risk of exploitation. Restrict access to sensitive data and ensure proper input validation to prevent potential disruptions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

ALT-PU-2020-1014

ALT-PU-2020-2032

BDU:2022-01676

CVE-2020-20892

DLA-3010-1

DSA-5126-1

OPENSUSE-SU-2021:3521-1

OPENSUSE-SU-2021_3521-1

SUSE-SU-2021:3521-1

SUSE-SU-2023:0005-1

USN-5167-1

Affected Products

Alt Linux

Astra Linux

Ffmpeg

Suse

Ubuntu

References · 209

• 🔥 https://trac.ffmpeg.org/ticket/8265 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22031 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22037 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3566 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35965 · Security Note
• https://ubuntu.com/security/CVE-2021-38114 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-20892 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38092 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22042 · Security Note
• https://ubuntu.com/security/CVE-2020-22040 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2020-1014 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-21041 · Security Note
• https://bdu.fstec.ru/vul/2021-05271 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22025 · Security Note
• https://bdu.fstec.ru/vul/2022-01676 · Security Note