PT-2021-5789 · FFmpeg+4 · Ffmpeg+4
Published
2019-09-11
·
Updated
2022-06-08
·
CVE-2020-22029
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FFmpeg version 4.2
Description
The issue is related to a heap-based Buffer Overflow vulnerability in the
slice get derivative function of the FFmpeg library. This vulnerability can be exploited by a remote attacker to gain access to confidential data, compromise data integrity, and cause a denial of service. The vulnerability is associated with a buffer overflow, which may lead to memory corruption and other potential consequences.Recommendations
For FFmpeg version 4.2, consider disabling the
slice get derivative function as a temporary workaround until a patch is available. Restrict access to the libavfilter/vf colorconstancy.c module to minimize the risk of exploitation. Avoid using the crossfade samples fltp function in conjunction with slice get derivative until the issue is resolved.Exploit
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Ffmpeg
Linuxmint
Ubuntu