Heap-based Buffer Overflow in FFmpeg 4.2: Critical Vulnerability in Multimedia Processing
Summary
UBUNTU-CVE-2020-22035: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in get_block_row at libavfilter/vf_bm3d.c, which might lead to memory corruption and other potential consequences. Affects qtwebengine-opensource-src versions 5.9.1+dfsg-4 – 5.9.5+dfsg-0ubuntu2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely-used open-source software suite for handling multimedia data, including audio and video processing. It provides libraries and tools to encode, decode, transcode, mux, demux, stream, filter, and play almost anything that humans and machines have created. The package is essential for developers and users who require robust multimedia capabilities. However, FFmpeg 4.2 has been found to contain a critical vulnerability that could lead to severe security risks.
Vulnerability Detail
A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in the function get_block_row located in libavfilter/vf_bm3d.c. This vulnerability can lead to memory corruption, which may allow an attacker to execute arbitrary code, potentially compromising the system's integrity and confidentiality. The vulnerability has a CVSS score of 8.8, indicating a high severity level, and it can be exploited remotely without user interaction.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functionalities of FFmpeg until the package is updated. Additionally, consider using alternative multimedia processing tools that do not have this vulnerability.
Conclusion
The heap-based buffer overflow vulnerability in FFmpeg 4.2 poses a significant risk to users and systems relying on this multimedia processing tool. It is crucial to update to the patched version to mitigate potential security threats. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for qtwebengine-opensource-src →
FAQ
The vulnerability is a heap-based buffer overflow that can lead to memory corruption and potential arbitrary code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
If you cannot update the package, avoid using the affected functionalities of FFmpeg and consider using alternative tools until the update can be applied.
More information can be found in the Ubuntu security notices and the official FFmpeg documentation regarding the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for qtwebengine-opensource-src.
