CVE-2020-13904

2020-06-0719:15:09

Google

osv.dev

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

6.6 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

49.0%

JSON

FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in av_probe_input_format3 in libavformat/format.c.

CPENameOperatorVersion
ffmpeg.giteqn2.8-de
ffmpeg.giteqn2.8.16
ffmpeg.giteqn2.8.3
ffmpeg.giteqn1.3-de
ffmpeg.giteqn2.2-de
ffmpeg.giteqn2.8.13
ffmpeg.giteqn0.8
ffmpeg.giteqn2.7-de
ffmpeg.giteqn2.8.11
ffmpeg.giteqn2.0

Name	Operator	Version
ffmpeg.git	eq	n2.8-de
ffmpeg.git	eq	n2.8.16
ffmpeg.git	eq	n2.8.3
ffmpeg.git	eq	n1.3-de
ffmpeg.git	eq	n2.2-de
ffmpeg.git	eq	n2.8.13
ffmpeg.git	eq	n0.8
ffmpeg.git	eq	n2.7-de
ffmpeg.git	eq	n2.8.11
ffmpeg.git	eq	n2.0