Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 523
Alerts This Week
Warning Icon 1 523

SUSE: 2021:2919-1 Important: ffmpeg Denial Of Service Issues Fixed

suse
Calendar Grey September 2, 2021
Scroller Suse
Significant SUSE Security Patch for ffmpeg tackles 8 weaknesses, rated as crucial. Prompt response advised.
An update that fixes 8 vulnerabilities is now available

Summary

This update for ffmpeg fixes the following issues: - CVE-2019-9721: Fix denial of service in the subtitle decoder in handle_open_brace from libavcodec/htmlsubtitles.c (bsc#1129714). - CVE-2020-22046: Fix a denial of service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avpriv_float_dsp_allocl function in libavutil/float_dsp.c (bsc#1186849). - CVE-2020-22048: Fix a denial of service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_frame_pool_get function in framepool.c (bsc#1186859). - CVE-2020-22049: Fix a denial of service vulnerability exists in FFmpeg 4.2 due to a memory leak in the wtvfile_open_sector function in wtvdec.c (bsc#1186861). - CVE-2020-22054: Fix a denial of service vulnerability exists in FFmpeg

Topics%20covered

Topics Covered

security advisory denial of service critical important SUSE ffmpeg heap issue

References

#1129714 #1186849 #1186859 #1186861 #1186863

#1189142 #1189348 #1189350

Cross- CVE-2019-9721 CVE-2020-21688 CVE-2020-21697

CVE-2020-22046 CVE-2020-22048 CVE-2020-22049

CVE-2020-22054 CVE-2021-38114

CVSS scores:

CVE-2019-9721 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2019-9721 (SUSE): 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CVE-2020-21688 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2020-21697 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2020-22046 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2020-22046 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2020-22048 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2021:2919-1
Rating: important

Topics%20covered

Topics Covered

security advisory denial of service critical important SUSE ffmpeg heap issue

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.