FFmpeg heap reuse vulnerability after release

FFmpeg is a set of open source computer programs that can be used to record, convert digital audio and video, and convert them to streams under the LGPL or GPL license. mpegmuxwritepacket function in libavformat/mpegenc.c in FFmpeg version 4.2 suffers from a heap-release post-reuse vulnerability...

CVE-2020-21697

A heap-use-after-free in the mpegmuxwritepacket function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service DOS via a crafted avi file...

CVE-2020-21688

A heap-use-after-free in the avfreep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code...

DEBIAN-CVE-2020-21697

A heap-use-after-free in the mpegmuxwritepacket function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service DOS via a crafted avi file...

DEBIAN-CVE-2020-21688

A heap-use-after-free in the avfreep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code...

Heap overflow

A heap-use-after-free in the mpegmuxwritepacket function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service DOS via a crafted avi file...

CVE-2020-21690

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-20451. Reason: This candidate is a duplicate of CVE-2020-20451. Notes: All CVE users should reference CVE-2020-20451 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

Heap overflow

A heap-use-after-free in the avfreep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code...

UBUNTU-CVE-2020-21688

A heap-use-after-free in the avfreep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code...

CVE-2020-21688

A heap-use-after-free in the avfreep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code...

CVE-2020-21688

CVE-2020-21688 describes a heap-use-after-free in FFmpeg’s libavutil/mem.c av_freep, affecting FFmpeg 4.2 and enabling arbitrary code execution under plausible conditions. Public references in connected documents indicate the issue pertains to FFmpeg 4.2, with surrounding advisories noting the vu...

CVE-2020-21688

A heap-use-after-free in the avfreep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code...

CVE-2020-21688

A heap-use-after-free in the avfreep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code...

CVE-2020-21688

A heap-use-after-free in the avfreep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code...

CVE-2020-21697

A heap-use-after-free in the mpegmuxwritepacket function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service DOS via a crafted avi file...

CVE-2020-21697

The CVE-2020-21697 entry concerns FFmpeg 4.2 with a heap-use-after-free in libavformat/mpegenc.c (mpeg_mux_write_packet) that allows denial of service via a crafted AVI file. Connected advisories confirm the issue in FFmpeg 4.2 and reference mitigations/upgrades (e.g., Ubuntu USN entries and Debi...

CVE-2020-21697

A heap-use-after-free in the mpegmuxwritepacket function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service DOS via a crafted avi file...

CVE-2020-21697

A heap-use-after-free in the mpegmuxwritepacket function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service DOS via a crafted avi file...

ffmpeg:ffmpeg_DEMUXER_fuzzer: Heap-buffer-overflow in mxf_get_d10_aes3_packet

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5387719147651072 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegDEMUXERfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 2 Crash Address: 0x63000000f444 Cra...

PT-2021-10657

Name of the Vulnerable Software and Affected Versions: FFmpeg version 4.2 Description: A memory leak in the grow array function in cmdutils.c of FFmpeg allows attackers to cause a denial of service via a crafted ogg file. Recommendations: For FFmpeg version 4.2, consider updating to a newer versi...