search

punesemu / puNES

Qt-based Nintendo Entertaiment System emulator and NSF/NSF2/NSFe Music Player (Linux, FreeBSD, OpenBSD and Windows)
GNU General Public License v2.0
657 stars 42 forks source link

CVE-2020-22029 (Medium) detected in FFmpeg0b3bd001ac1745d9d008a2d195817df57d7d1d14 #148

Closed mend-bolt-for-github[bot] closed 3 years ago

mend-bolt-for-github[bot] commented 3 years ago

CVE-2020-22029 - Medium Severity Vulnerability

Vulnerable Library - FFmpeg0b3bd001ac1745d9d008a2d195817df57d7d1d14

Mirror of git://source.ffmpeg.org/ffmpeg.git

Library home page: https://github.com/FFmpeg/FFmpeg.git

Found in base branch: master

Vulnerable Source Files (1)

puNES/src/extra/windows/ffmpeg/src/ffmpeg-git-7800cc6-10122020.tar/ffmpeg-7800cc6/libavfilter/vf_colorconstancy.c

Vulnerability Details

A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_colorconstancy.c: in slice_get_derivative, which crossfade_samples_fltp, which might lead to memory corruption and other potential consequences.

Publish Date: 2021-05-27

URL: CVE-2020-22029

CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/FFmpeg/FFmpeg/commit/a7fd1279703683ebb548ef7baa2f1519994496ae

Release Date: 2021-05-27

Fix Resolution: n4.3

Step up your Open Source Security Game with WhiteSource here

punesemu commented 3 years ago

Fixed with https://github.com/punesemu/puNES/commit/07fd123f62b2d075894a0cc966124db7b427b791.