USN-5167-1 — ffmpeg vulnerabilities

Summary

It was discovered that FFmpeg did not properly verify certain input when
processing video and audio files. An attacker could possibly use this to send
specially crafted input to the application, force a division by zero, and
cause a denial of service (application crash). (CVE-2020-20445, CVE-2020-20446,
CVE-2020-20453, CVE-2020-20892)

It was discovered that FFmpeg did not properly perform certain bit shift and
memory operations. An attacker could possibly use this issue to expose
sensitive information. (CVE-2020-20902)

It was discovered that FFmpeg did not properly perform memory management
operations in various of its functions. An attacker could possibly use this
issue to send specially crafted input to the application and cause a denial of
service (application crash) or execute arbitrary code. (CVE-2020-21041,
CVE-2020-20451, CVE-2020-21688, CVE-2020-21697, CVE-2020-22020,
CVE-2020-22021, CVE-2020-22022, CVE-2020-22025, CVE-2020-22031,
CVE-2020-22032, CVE-2020-22037, CVE-2020-22040, CVE-2020-22041,
CVE-2020-22042, CVE-2020-22044)

It was discovered that FFmpeg did not properly handle data assigned to the tty
demuxer. An attacker could possibly use this issue to send specially crafted
input to the application and expose sensitive information. (CVE-2021-3566)

It was discovered that FFmpeg did not perform checks on function return
values when encoding and formatting input video and audio files. An attacker
could possibly use this issue to cause a denial of service (application crash)
or execute arbitrary code. (CVE-2021-38114, CVE-2021-38171)

It was discovered that FFmpeg did not properly sanitize function returned data
when calculating frame duration values. An attacker could possibly use this
issue to cause an assertion failure and then cause a denial of service
(application crash). (CVE-2021-38291)

Fixed packages 1

Release	Package	Fixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS	ffmpeg	7:2.8.17-0ubuntu0.1+esm4

Vulnerabilities 29

Unscored —

CVE-2020-20445

FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious user to cause a …

ffmpeg ffmpeg Debian Ubuntu

May 25, 2021
Unscored —

CVE-2020-20446

FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious user to cause…

ffmpeg ffmpeg ffmpeg ffmpeg4 Debian Ubuntu Alpine

May 25, 2021
Unscored —

CVE-2020-20451

Denial of Service issue in FFmpeg 4.2 due to resource management errors via fftools/cmdutils.c.

ffmpeg ffmpeg Debian Ubuntu

May 25, 2021
Unscored —

CVE-2020-20453

FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aaccoder, which allows a remote malicious user to cause…

ffmpeg ffmpeg ffmpeg ffmpeg4 Debian Ubuntu Alpine

May 25, 2021
Unscored —

CVE-2020-20892

An issue was discovered in function filter_frame in libavfilter/vf_lenscorrection.c in Ffmpeg 4.2.1, allows attackers t…

ffmpeg ffmpeg qtwebengine-opensource-src Debian Ubuntu

Sep 20, 2021
Unscored —

CVE-2020-20902

A CWE-125: Out-of-bounds read vulnerability exists in long_term_filter function in g729postfilter.c in FFmpeg 4.2.1 dur…

ffmpeg ffmpeg Debian Ubuntu

Sep 20, 2021
Unscored —

CVE-2020-21041

Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng_do_inverse_blend in libavcodec/pngenc.c, which could let a …

ffmpeg ffmpeg ffmpeg ffmpeg4 Debian Ubuntu Alpine

May 24, 2021
Unscored —

CVE-2020-21688

A heap-use-after-free in the av_freep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary c…

ffmpeg ffmpeg qtwebengine-opensource-src Debian Ubuntu

Aug 10, 2021
Unscored —

CVE-2020-21697

A heap-use-after-free in the mpeg_mux_write_packet function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a de…

ffmpeg ffmpeg qtwebengine-opensource-src Debian Ubuntu

Aug 10, 2021
Unscored —

CVE-2020-22016

A heap-based Buffer Overflow vulnerability in FFmpeg 4.2 at libavcodec/get_bits.h when writing .mov files, which might …

ffmpeg ffmpeg Debian Ubuntu

May 27, 2021
Unscored —

CVE-2020-22020

Buffer Overflow vulnerability in FFmpeg 4.2 in the build_diff_map function in libavfilter/vf_fieldmatch.c, which could …

ffmpeg ffmpeg Debian Ubuntu

May 26, 2021
Unscored —

CVE-2020-22021

Buffer Overflow vulnerability in FFmpeg 4.2 at filter_edges function in libavfilter/vf_yadif.c, which could let a remot…

ffmpeg ffmpeg ffmpeg ffmpeg4 Debian Ubuntu Alpine

May 26, 2021
Unscored —

CVE-2020-22022

A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_fieldorder.c, which m…

ffmpeg ffmpeg qtwebengine-opensource-src Debian Ubuntu

May 27, 2021
Unscored —

CVE-2020-22025

A heap-based Buffer Overflow vulnerability exists in gaussian_blur at libavfilter/vf_edgedetect.c, which might lead to …

ffmpeg ffmpeg qtwebengine-opensource-src Debian Ubuntu

May 27, 2021
Unscored —

CVE-2020-22031

A Heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_w3fdif.c in filter16_complex_low, whi…

ffmpeg ffmpeg Debian Ubuntu

May 27, 2021
Unscored —

CVE-2020-22032

A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_edgedetect.c in gaussian_blur, which mig…

ffmpeg ffmpeg qtwebengine-opensource-src Debian Ubuntu

May 27, 2021
Unscored —

CVE-2020-22037

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodec_alloc_context3 at options.c.

ffmpeg ffmpeg ffmpeg ffmpeg4 Debian Ubuntu Alpine

Jun 1, 2021
Unscored —

CVE-2020-22040

A Denial of Service vulnerability exists in FFmpeg 4.2 idue to a memory leak in the v_frame_alloc function in frame.c.

ffmpeg ffmpeg Debian Ubuntu

Jun 1, 2021
Unscored —

CVE-2020-22041

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_buffersrc_add_frame_flags functio…

ffmpeg ffmpeg Debian Ubuntu

Jun 1, 2021
Unscored —

CVE-2020-22042

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak is affected by: memory leak in the link_fil…

ffmpeg ffmpeg ffmpeg ffmpeg4 Debian Ubuntu Alpine

Jun 1, 2021
Unscored —

CVE-2020-22044

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the url_open_dyn_buf_internal function i…

ffmpeg ffmpeg Debian Ubuntu

Jun 1, 2021
Unscored —

CVE-2020-22046

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avpriv_float_dsp_allocl function in …

ffmpeg ffmpeg Debian Ubuntu

Jun 2, 2021
Unscored —

CVE-2020-22049

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the wtvfile_open_sector function in wtvd…

ffmpeg ffmpeg Debian Ubuntu

Jun 2, 2021
Unscored —

CVE-2020-22054

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_dict_set function in dict.c.

ffmpeg ffmpeg Debian Ubuntu

Jun 2, 2021
Unscored —

CVE-2020-35965

decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when t…

ffmpeg ffmpeg ffmpeg ffmpeg4 Debian Ubuntu Alpine

Jan 4, 2021
Unscored —

CVE-2021-3566

Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitim…

ffmpeg ffmpeg Debian Ubuntu

Aug 5, 2021
Unscored —

CVE-2021-38114

libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-20…

ffmpeg ffmpeg ffmpeg ffmpeg4 Debian Ubuntu Alpine

Aug 4, 2021
Unscored —

CVE-2021-38171

adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a …

ffmpeg ffmpeg ffmpeg ffmpeg4 Debian Ubuntu Alpine

Aug 21, 2021
Unscored —

CVE-2021-38291

FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavut…

ffmpeg ffmpeg ffmpeg ffmpeg4 Debian Ubuntu Alpine

Aug 12, 2021

References

report
https://ubuntu.com/security/CVE-2020-20445
report
https://ubuntu.com/security/CVE-2020-20446
report
https://ubuntu.com/security/CVE-2020-20451
report
https://ubuntu.com/security/CVE-2020-20453
report
https://ubuntu.com/security/CVE-2020-20892
report
https://ubuntu.com/security/CVE-2020-20902
report
https://ubuntu.com/security/CVE-2020-21041
report
https://ubuntu.com/security/CVE-2020-21688
report
https://ubuntu.com/security/CVE-2020-21697
report
https://ubuntu.com/security/CVE-2020-22016
report
https://ubuntu.com/security/CVE-2020-22020
report
https://ubuntu.com/security/CVE-2020-22021
report
https://ubuntu.com/security/CVE-2020-22022
report
https://ubuntu.com/security/CVE-2020-22025
report
https://ubuntu.com/security/CVE-2020-22031
report
https://ubuntu.com/security/CVE-2020-22032
report
https://ubuntu.com/security/CVE-2020-22037
report
https://ubuntu.com/security/CVE-2020-22040
report
https://ubuntu.com/security/CVE-2020-22041
report
https://ubuntu.com/security/CVE-2020-22042
report
https://ubuntu.com/security/CVE-2020-22044
report
https://ubuntu.com/security/CVE-2020-22046
report
https://ubuntu.com/security/CVE-2020-22049
report
https://ubuntu.com/security/CVE-2020-22054
report
https://ubuntu.com/security/CVE-2020-35965
report
https://ubuntu.com/security/CVE-2021-3566
report
https://ubuntu.com/security/CVE-2021-38114
report
https://ubuntu.com/security/CVE-2021-38171
report
https://ubuntu.com/security/CVE-2021-38291

ffmpeg vulnerabilities

Summary

Fixed packages 1

Vulnerabilities 29

FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious user to cause a …

FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious user to cause…

Denial of Service issue in FFmpeg 4.2 due to resource management errors via fftools/cmdutils.c.

FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aaccoder, which allows a remote malicious user to cause…

An issue was discovered in function filter_frame in libavfilter/vf_lenscorrection.c in Ffmpeg 4.2.1, allows attackers t…

A CWE-125: Out-of-bounds read vulnerability exists in long_term_filter function in g729postfilter.c in FFmpeg 4.2.1 dur…

Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng_do_inverse_blend in libavcodec/pngenc.c, which could let a …

A heap-use-after-free in the av_freep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary c…

A heap-use-after-free in the mpeg_mux_write_packet function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a de…

A heap-based Buffer Overflow vulnerability in FFmpeg 4.2 at libavcodec/get_bits.h when writing .mov files, which might …

Buffer Overflow vulnerability in FFmpeg 4.2 in the build_diff_map function in libavfilter/vf_fieldmatch.c, which could …

Buffer Overflow vulnerability in FFmpeg 4.2 at filter_edges function in libavfilter/vf_yadif.c, which could let a remot…

A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_fieldorder.c, which m…

A heap-based Buffer Overflow vulnerability exists in gaussian_blur at libavfilter/vf_edgedetect.c, which might lead to …

A Heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_w3fdif.c in filter16_complex_low, whi…

A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_edgedetect.c in gaussian_blur, which mig…

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodec_alloc_context3 at options.c.

A Denial of Service vulnerability exists in FFmpeg 4.2 idue to a memory leak in the v_frame_alloc function in frame.c.

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_buffersrc_add_frame_flags functio…

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak is affected by: memory leak in the link_fil…

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the url_open_dyn_buf_internal function i…

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avpriv_float_dsp_allocl function in …

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the wtvfile_open_sector function in wtvd…

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_dict_set function in dict.c.

decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when t…

Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it. By crafting a legitim…

libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-20…

adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a …

FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavut…

References