PT-2021-6725 · FFmpeg+5 · Ffmpeg+5

Published 2019-09-11 · Updated 2022-06-13 · CVE-2020-21688

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FFmpeg version 4.2

Description A heap-use-after-free issue in the av freep function of the libavutil/mem.c component in FFmpeg allows attackers to execute arbitrary code, potentially leading to unauthorized access to confidential data, disruption of data integrity, and denial of service.

Recommendations For FFmpeg version 4.2, consider updating to a newer version that addresses this issue, as the current version allows for the execution of arbitrary code due to the heap-use-after-free vulnerability in the av freep function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2019-2678

BDU:2022-02095

CVE-2020-21688

DLA-3010-1

DSA-4998-1

DSA-5126-1

OPENSUSE-SU-2021:2919-1

OPENSUSE-SU-2021_2919-1

SUSE-SU-2021:2919-1

SUSE-SU-2021:2929-1

USN-5167-1

USN-5472-1

Affected Products

Alt Linux

Astra Linux

Ffmpeg

Linuxmint

Suse

Ubuntu

References · 133

• 🔥 https://trac.ffmpeg.org/ticket/8186 · Exploit
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0426SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-22022 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-22036 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-22017 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2919-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5472-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-20450 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2929-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-22044 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:2919-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-21688 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-22028 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-22025 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38291 · Vendor Advisory