PT-2019-6402 · FFmpeg+4 · Ffmpeg+4

Published 2019-08-26 · Updated 2022-06-13 · CVE-2020-20451

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FFmpeg version 4.2

Description The issue is related to a component of the FFmpeg multimedia library, specifically fftools/cmdutils.c, which is associated with incorrect memory deallocation before removing the last reference. This allows a remote attacker to cause a denial of service. The problem stems from resource management errors.

Recommendations For FFmpeg version 4.2, consider applying configuration changes or workarounds to minimize the risk of exploitation, such as restricting access to resources that could be affected by the denial of service issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALT-PU-2019-2678

BDU:2023-07816

CVE-2020-20451

DLA-2818-1

OPENSUSE-SU-2021:2322-1

OPENSUSE-SU-2021_2322-1

SUSE-SU-2021:2322-1

SUSE-SU-2021:2929-1

USN-5167-1

Affected Products

Alt Linux

Astra Linux

Ffmpeg

Suse

Ubuntu

References · 291

• 🔥 https://trac.ffmpeg.org/ticket/8094 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22037 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3566 · Security Note
• https://ubuntu.com/security/CVE-2021-38114 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22042 · Security Note
• https://bdu.fstec.ru/vul/2021-05314 · Security Note
• https://bdu.fstec.ru/vul/2022-00243 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-21041 · Security Note
• https://bdu.fstec.ru/vul/2021-05187 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22022 · Security Note
• https://bdu.fstec.ru/vul/2022-01801 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-20445 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22039 · Security Note
• https://bdu.fstec.ru/vul/2021-05155 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-20451 · Security Note