A ffmpeg security update has been released for Debian GNU/Linux 9 LTS.
DLA 2818-1: ffmpeg security update
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2818-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Anton Gladky
November 13, 2021 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : ffmpeg
Version : 7:3.2.16-1+deb9u1
CVE ID : CVE-2020-20445 CVE-2020-20446 CVE-2020-20451 CVE-2020-20453
CVE-2020-22037 CVE-2020-22041 CVE-2020-22044 CVE-2020-22046
CVE-2020-22048 CVE-2020-22049 CVE-2020-22054 CVE-2021-38171
CVE-2021-38291
Multiple issues have been discovered in ffmpeg - tools for transcoding,
streaming and playing of multimedia files.
CVE-2020-20445
Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious
user to cause a Denial of Service.
CVE-2020-20446
Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious
user to cause a Denial of Service.
CVE-2020-20451
Denial of Service issue due to resource management errors via
fftools/cmdutils.c.
CVE-2020-20453
Divide By Zero issue via libavcodec/aaccoder, which allows a remote
malicious user to cause a Denial of Service.
CVE-2020-22037
A Denial of Service vulnerability due to a memory leak in
avcodec_alloc_context3 at options.c
CVE-2020-22041
A Denial of Service vulnerability due to a memory leak in
the av_buffersrc_add_frame_flags function in buffersrc.
CVE-2020-22044
A Denial of Service vulnerability due to a memory leak in the
url_open_dyn_buf_internal function in libavformat/aviobuf.c.
CVE-2020-22046
A Denial of Service vulnerability due to a memory leak in the
avpriv_float_dsp_allocl function in libavutil/float_dsp.c.
CVE-2020-22048
A Denial of Service vulnerability due to a memory leak in the
ff_frame_pool_get function in framepool.c.
CVE-2020-22049
A Denial of Service vulnerability due to a memory leak in the
wtvfile_open_sector function in wtvdec.c.
CVE-2020-22054
A Denial of Service vulnerability due to a memory leak in the av_dict_set
function in dict.c.
CVE-2021-38171
adts_decode_extradata in libavformat/adtsenc.c does not check the
init_get_bits return value, which is a necessary step because the second
argument to init_get_bits can be crafted.
CVE-2021-38291
Assertion failure at src/libavutil/mathematics.c, causing ffmpeg aborted
is detected. In some extrme cases, like with adpcm_ms samples with an
extremely high channel count, get_audio_frame_duration() may return a
negative frame duration value.
For Debian 9 stretch, these problems have been fixed in version
7:3.2.16-1+deb9u1.
We recommend that you upgrade your ffmpeg packages.
For the detailed security status of ffmpeg please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ffmpeg
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS