search

punesemu / puNES

Qt-based Nintendo Entertaiment System emulator and NSF/NSF2/NSFe Music Player (Linux, FreeBSD, OpenBSD and Windows)
GNU General Public License v2.0
657 stars 42 forks source link

CVE-2020-22040 (Medium) detected in ffmpeg4.3.1 #176

Closed mend-bolt-for-github[bot] closed 2 years ago

mend-bolt-for-github[bot] commented 2 years ago

CVE-2020-22040 - Medium Severity Vulnerability

Vulnerable Library - ffmpeg4.3.1

Library home page: https://ffmpeg.org/releases/

Found in HEAD commit: 719dd4acdef315326081eddb24a741d51d01410d

Found in base branch: master

Vulnerable Source Files (1)

/src/extra/windows/ffmpeg/src/ffmpeg-4.4.1.tar/ffmpeg-4.4.1/libavfilter/f_reverse.c

Vulnerability Details

A Denial of Service vulnerability exists in FFmpeg 4.2 idue to a memory leak in the v_frame_alloc function in frame.c.

Publish Date: 2021-06-01

URL: CVE-2020-22040

CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22040

Release Date: 2021-06-01

Fix Resolution: n4.3

Step up your Open Source Security Game with WhiteSource here

punesemu commented 2 years ago

This is already fixed in FFMpeg 4.4.1.