Vulnerability · Published Apr 28, 2020 · Assigned by mitre
CVE-2020-12284
Critical 9.8
In plain English
A critical-severity security flaw in the ffmpeg package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)3.9%top 9.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | ffmpeg | 4.3-r0 | ALPINE-CVE-2020-12284 |
| Alpine:v3.21 | ffmpeg | 4.3-r0 | ALPINE-CVE-2020-12284 |
| Alpine:v3.22 | ffmpeg | 4.3-r0 | ALPINE-CVE-2020-12284 |
| Alpine:v3.23 | ffmpeg | 4.3-r0 | ALPINE-CVE-2020-12284 |
| Alpine:v3.24 | ffmpeg | 4.3-r0 | ALPINE-CVE-2020-12284 |
| Alpine:v3.20 | ffmpeg4 | 4.3-r0 | ALPINE-CVE-2020-12284 |
| Alpine:v3.21 | ffmpeg4 | 4.3-r0 | ALPINE-CVE-2020-12284 |
| Alpine:v3.22 | ffmpeg4 | 4.3-r0 | ALPINE-CVE-2020-12284 |
| Debian:12 | ffmpeg | 7:4.2.3-1 | DEBIAN-CVE-2020-12284 |
| Debian:13 | ffmpeg | 7:4.2.3-1 | DEBIAN-CVE-2020-12284 |
| Debian:14 | ffmpeg | 7:4.2.3-1 | DEBIAN-CVE-2020-12284 |
Affected products (as reported)
References
- https://github.com/FFmpeg/FFmpeg/commit/1812352d767ccf5431aa440123e2e260a4db2726 x_refsource_MISC
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19734 x_refsource_MISC
- DSA-4722 vendor-advisory, x_refsource_DEBIAN
- USN-4431-1 vendor-advisory, x_refsource_UBUNTU
- GLSA-202007-58 vendor-advisory, x_refsource_GENTOO
- https://github.com/FFmpeg/FFmpeg/commit/a3a3730b5456ca00587455004d40c047f7b20a99 x_refsource_MISC