Lucene search

K
osvGoogleOSV:USN-6430-1
HistoryOct 12, 2023 - 3:14 p.m.

ffmpeg vulnerabilities

2023-10-1215:14:30
Google
osv.dev
8
ffmpeg
buffer overflow
memory leak
denial of service
ubuntu 16.04 lts
ubuntu 18.04 lts
ubuntu 20.04 lts
mov file
integer overflow

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

43.1%

It was discovered that FFmpeg did not properly handle certain inputs in
vf_lagfun.c, resulting in a buffer overflow vulnerability. An attacker
could possibly use this issue to cause a denial of service via application
crash. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-22024)

It was discovered that FFmpeg incorrectly managed memory in avienc.c,
resulting in a memory leak. An attacker could possibly use this issue
to cause a denial of service via application crash. (CVE-2020-22039)

It was discovered that FFmpeg incorrectly handled certain files due to a
memory leak in frame.c. An attacker could possibly use this issue to cause
a denial of service via application crash. This issue affected
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-22040)

It was discovered that FFmpeg incorrectly handled certain files due to a
memory leak in fifo.c. An attacker could possibly use this issue to cause
a denial of service via application crash. (CVE-2020-22043)

It was discovered that FFmpeg incorrectly handled certain files due to a
memory leak in vf_tile.c. If a user or automated system were tricked into
processing a specially crafted MOV file, an attacker could possibly use
this issue to cause a denial of service. (CVE-2020-22051)

It was discovered that FFmpeg incorrectly handled certain MOV files in
timecode.c, leading to an integer overflow. An attacker could possibly
use this issue to cause a denial of service using a crafted MOV file.
This issue only affected Ubuntu 16.04 LTS. (CVE-2021-28429)

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

43.1%