search

punesemu / puNES

Qt-based Nintendo Entertaiment System emulator and NSF/NSF2/NSFe Music Player (Linux, FreeBSD, OpenBSD and Windows)
GNU General Public License v2.0
657 stars 42 forks source link

CVE-2020-20902 (Medium) detected in ffmpeg4.3.1 #177

Closed mend-bolt-for-github[bot] closed 2 years ago

mend-bolt-for-github[bot] commented 2 years ago

CVE-2020-20902 - Medium Severity Vulnerability

Vulnerable Library - ffmpeg4.3.1

Library home page: https://ffmpeg.org/releases/

Found in HEAD commit: 719dd4acdef315326081eddb24a741d51d01410d

Found in base branch: master

Vulnerable Source Files (1)

/src/extra/windows/ffmpeg/src/ffmpeg-4.4.1.tar/ffmpeg-4.4.1/libavcodec/g729postfilter.c

Vulnerability Details

A CWE-125: Out-of-bounds read vulnerability exists in long_term_filter function in g729postfilter.c in FFmpeg 4.2.1 during computation of the denominator of pseudo-normalized correlation R'(0), that could result in disclosure of information.

Publish Date: 2021-09-20

URL: CVE-2020-20902

CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/FFmpeg/FFmpeg/commit/0c61661a2cbe1b8b284c80ada1c2fdddf4992cad

Release Date: 2021-09-20

Fix Resolution: n4.3

Step up your Open Source Security Game with WhiteSource here

punesemu commented 2 years ago

This is already fixed in FFMpeg 4.4.1.