Vulnerability · Published Jun 7, 2020 · Assigned by mitre
CVE-2020-13904
Medium 5.5
In plain English
A medium-severity security flaw in the ffmpeg package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)1.3%top 29.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in av_probe_input_format3 in libavformat/format.c.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | ffmpeg | 4.3-r0 | ALPINE-CVE-2020-13904 |
| Alpine:v3.21 | ffmpeg | 4.3-r0 | ALPINE-CVE-2020-13904 |
| Alpine:v3.22 | ffmpeg | 4.3-r0 | ALPINE-CVE-2020-13904 |
| Alpine:v3.23 | ffmpeg | 4.3-r0 | ALPINE-CVE-2020-13904 |
| Alpine:v3.24 | ffmpeg | 4.3-r0 | ALPINE-CVE-2020-13904 |
| Alpine:v3.20 | ffmpeg4 | 4.3-r0 | ALPINE-CVE-2020-13904 |
| Alpine:v3.21 | ffmpeg4 | 4.3-r0 | ALPINE-CVE-2020-13904 |
| Alpine:v3.22 | ffmpeg4 | 4.3-r0 | ALPINE-CVE-2020-13904 |
| Debian:12 | ffmpeg | 7:4.3.1-1 | DEBIAN-CVE-2020-13904 |
| Debian:13 | ffmpeg | 7:4.3.1-1 | DEBIAN-CVE-2020-13904 |
| Debian:14 | ffmpeg | 7:4.3.1-1 | DEBIAN-CVE-2020-13904 |
Affected products (as reported)
References
- https://trac.ffmpeg.org/ticket/8673 x_refsource_MISC
- https://patchwork.ffmpeg.org/project/ffmpeg/patch/20200529033905.41926-1-lq%40chinaffmpeg.org/ x_refsource_MISC
- DSA-4722 vendor-advisory, x_refsource_DEBIAN
- [debian-lts-announce] 20200727 [SECURITY] [DLA 2291-1] ffmpeg security update mailing-list, x_refsource_MLIST
- USN-4431-1 vendor-advisory, x_refsource_UBUNTU
- GLSA-202007-58 vendor-advisory, x_refsource_GENTOO
- https://github.com/FFmpeg/FFmpeg/commit/6959358683c7533f586c07a766acc5fe9544d8b2 x_refsource_MISC