Bugzilla – Bug 1186586
VUL-1: CVE-2020-22021: ffmpeg: Buffer Overflow vulnerability in filter_edges function in libavfilter/vf_yadif.c
Last modified: 2024-07-10 13:26:32 UTC
CVE-2020-22021 Buffer Overflow vulnerability in FFmpeg 4.2 at filter_edges function in libavfilter/vf_yadif.c, which could let a remote malicious user cause a Denial of Service. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-22021 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22021 https://trac.ffmpeg.org/ticket/8240
tracking as affected: - SUSE:SLE-15:Update/ffmpeg - SUSE:SLE-15-SP2:Update/ffmpeg
ffmpeg 3.4.2 asan: ==28616==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x616000010e7f at pc 0x000000800baa bp 0x7fcae9ff5ba0 sp 0x7fcae9ff5b98 READ of size 1 at 0x616000010e7f thread T18 #0 0x800ba9 in filter_edges libavfilter/vf_yadif.c:137 #1 0x804508 in filter_slice libavfilter/vf_yadif.c:212 #2 0x657dfb in worker_func libavfilter/pthread.c:50 #3 0x26720c8 in run_jobs libavutil/slicethread.c:61 #4 0x26720c8 in thread_worker libavutil/slicethread.c:85 #5 0x7fcaf1cf14f8 in start_thread (/lib64/libpthread.so.0+0x84f8) #6 0x7fcaf1a29ece in clone (/lib64/libc.so.6+0xfbece)
https://build.suse.de/request/show/243003
openSUSE-SU-2021:2322-1: An update that fixes 23 vulnerabilities is now available. Category: security (important) Bug References: 1172640,1186406,1186583,1186586,1186587,1186596,1186597,1186598,1186600,1186603,1186604,1186605,1186613,1186614,1186615,1186616,1186658,1186660,1186757,1186758,1186762,1186763 CVE References: CVE-2019-17539,CVE-2020-13904,CVE-2020-20448,CVE-2020-20451,CVE-2020-21041,CVE-2020-22015,CVE-2020-22016,CVE-2020-22017,CVE-2020-22019,CVE-2020-22020,CVE-2020-22021,CVE-2020-22022,CVE-2020-22023,CVE-2020-22025,CVE-2020-22026,CVE-2020-22031,CVE-2020-22032,CVE-2020-22033,CVE-2020-22034,CVE-2020-22038,CVE-2020-22039,CVE-2020-22043,CVE-2020-22044 JIRA References: Sources used: openSUSE Leap 15.3 (src): ffmpeg-3.4.2-11.3.1
SUSE-SU-2021:2322-1: An update that fixes 23 vulnerabilities is now available. Category: security (important) Bug References: 1172640,1186406,1186583,1186586,1186587,1186596,1186597,1186598,1186600,1186603,1186604,1186605,1186613,1186614,1186615,1186616,1186658,1186660,1186757,1186758,1186762,1186763 CVE References: CVE-2019-17539,CVE-2020-13904,CVE-2020-20448,CVE-2020-20451,CVE-2020-21041,CVE-2020-22015,CVE-2020-22016,CVE-2020-22017,CVE-2020-22019,CVE-2020-22020,CVE-2020-22021,CVE-2020-22022,CVE-2020-22023,CVE-2020-22025,CVE-2020-22026,CVE-2020-22031,CVE-2020-22032,CVE-2020-22033,CVE-2020-22034,CVE-2020-22038,CVE-2020-22039,CVE-2020-22043,CVE-2020-22044 JIRA References: Sources used: SUSE Linux Enterprise Workstation Extension 15-SP3 (src): ffmpeg-3.4.2-11.3.1 SUSE Linux Enterprise Workstation Extension 15-SP2 (src): ffmpeg-3.4.2-11.3.1 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (src): ffmpeg-3.4.2-11.3.1 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP2 (src): ffmpeg-3.4.2-11.3.1 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (src): ffmpeg-3.4.2-11.3.1 SUSE Linux Enterprise Module for Desktop Applications 15-SP2 (src): ffmpeg-3.4.2-11.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice SUSE-SU-2021:2929-1: An update that fixes 31 vulnerabilities is now available. Category: security (important) Bug References: 1129714,1172640,1186406,1186583,1186586,1186587,1186596,1186597,1186598,1186600,1186603,1186604,1186605,1186613,1186614,1186615,1186616,1186658,1186660,1186757,1186758,1186762,1186763,1186849,1186859,1186861,1186863,1189142,1189348,1189350 CVE References: CVE-2019-17539,CVE-2019-9721,CVE-2020-13904,CVE-2020-20448,CVE-2020-20451,CVE-2020-21041,CVE-2020-21688,CVE-2020-21697,CVE-2020-22015,CVE-2020-22016,CVE-2020-22017,CVE-2020-22019,CVE-2020-22020,CVE-2020-22021,CVE-2020-22022,CVE-2020-22023,CVE-2020-22025,CVE-2020-22026,CVE-2020-22031,CVE-2020-22032,CVE-2020-22033,CVE-2020-22034,CVE-2020-22038,CVE-2020-22039,CVE-2020-22043,CVE-2020-22044,CVE-2020-22046,CVE-2020-22048,CVE-2020-22049,CVE-2020-22054,CVE-2021-38114 JIRA References: Sources used: SUSE Manager Server 4.0 (src): ffmpeg-3.4.2-4.34.2 SUSE Manager Retail Branch Server 4.0 (src): ffmpeg-3.4.2-4.34.2 SUSE Manager Proxy 4.0 (src): ffmpeg-3.4.2-4.34.2 SUSE Linux Enterprise Server for SAP 15-SP1 (src): ffmpeg-3.4.2-4.34.2 SUSE Linux Enterprise Server for SAP 15 (src): ffmpeg-3.4.2-4.34.2 SUSE Linux Enterprise Server 15-SP1-LTSS (src): ffmpeg-3.4.2-4.34.2 SUSE Linux Enterprise Server 15-SP1-BCL (src): ffmpeg-3.4.2-4.34.2 SUSE Linux Enterprise Server 15-LTSS (src): ffmpeg-3.4.2-4.34.2 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): ffmpeg-3.4.2-4.34.2 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): ffmpeg-3.4.2-4.34.2 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): ffmpeg-3.4.2-4.34.2 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): ffmpeg-3.4.2-4.34.2 SUSE Enterprise Storage 6 (src): ffmpeg-3.4.2-4.34.2 SUSE CaaS Platform 4.0 (src): ffmpeg-3.4.2-4.34.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
https://build.suse.de/request/show/331715 SLE-16-GA
https://build.suse.de/request/show/331717 SLE-15-SP4
https://build.suse.de/request/show/331877 SLE-16:Update
Patch merged.
SUSE-SU-2024:1909-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1186586, 1223437 CVE References: CVE-2020-22021, CVE-2023-51794 Maintenance Incident: [SUSE:Maintenance:34059](https://smelt.suse.de/incident/34059/) Sources used: openSUSE Leap 15.6 (src): ffmpeg-4-4.4-150600.13.5.1 SUSE Package Hub 15 15-SP6 (src): ffmpeg-4-4.4-150600.13.5.1 SUSE Linux Enterprise Workstation Extension 15 SP6 (src): ffmpeg-4-4.4-150600.13.5.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1907-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1186586, 1223437 CVE References: CVE-2020-22021, CVE-2023-51794 Maintenance Incident: [SUSE:Maintenance:34008](https://smelt.suse.de/incident/34008/) Sources used: openSUSE Leap 15.4 (src): ffmpeg-4-4.4-150400.3.32.1 openSUSE Leap 15.5 (src): ffmpeg-4-4.4-150400.3.32.1 SUSE Package Hub 15 15-SP5 (src): ffmpeg-4-4.4-150400.3.32.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): ffmpeg-4-4.4-150400.3.32.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): ffmpeg-4-4.4-150400.3.32.1 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): ffmpeg-4-4.4-150400.3.32.1 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): ffmpeg-4-4.4-150400.3.32.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): ffmpeg-4-4.4-150400.3.32.1 SUSE Linux Enterprise Workstation Extension 15 SP5 (src): ffmpeg-4-4.4-150400.3.32.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
All done, closing.