- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2818-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                         Anton Gladky
November 13, 2021                             https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : ffmpeg
Version        : 7:3.2.16-1+deb9u1
CVE ID         : CVE-2020-20445 CVE-2020-20446 CVE-2020-20451 CVE-2020-20453 
                 CVE-2020-22037 CVE-2020-22041 CVE-2020-22044 CVE-2020-22046 
                 CVE-2020-22048 CVE-2020-22049 CVE-2020-22054 CVE-2021-38171
                 CVE-2021-38291

Multiple issues have been discovered in ffmpeg - tools for transcoding,
streaming and playing of multimedia files.

CVE-2020-20445

    Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious
    user to cause a Denial of Service.

CVE-2020-20446

    Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious
    user to cause a Denial of Service.

CVE-2020-20451

    Denial of Service issue due to resource management errors via
    fftools/cmdutils.c.

CVE-2020-20453

    Divide By Zero issue via libavcodec/aaccoder, which allows a remote
    malicious user to cause a Denial of Service.

CVE-2020-22037

    A Denial of Service vulnerability due to a memory leak in
    avcodec_alloc_context3 at options.c

CVE-2020-22041

    A Denial of Service vulnerability due to a memory leak in
    the av_buffersrc_add_frame_flags function in buffersrc.

CVE-2020-22044

    A Denial of Service vulnerability due to a memory leak in the
    url_open_dyn_buf_internal function in libavformat/aviobuf.c.

CVE-2020-22046

    A Denial of Service vulnerability due to a memory leak in the
    avpriv_float_dsp_allocl function in libavutil/float_dsp.c.

CVE-2020-22048

    A Denial of Service vulnerability due to a memory leak in the
    ff_frame_pool_get function in framepool.c.

CVE-2020-22049

    A Denial of Service vulnerability due to a memory leak in the
    wtvfile_open_sector function in wtvdec.c.

CVE-2020-22054

    A Denial of Service vulnerability due to a memory leak in the av_dict_set
    function in dict.c.

CVE-2021-38171

    adts_decode_extradata in libavformat/adtsenc.c does not check the
    init_get_bits return value, which is a necessary step because the second
    argument to init_get_bits can be crafted.

CVE-2021-38291

    Assertion failure at src/libavutil/mathematics.c, causing ffmpeg aborted
    is detected. In some extrme cases, like with adpcm_ms samples with an
    extremely high channel count, get_audio_frame_duration() may return a
    negative frame duration value.


For Debian 9 stretch, these problems have been fixed in version
7:3.2.16-1+deb9u1.

We recommend that you upgrade your ffmpeg packages.

For the detailed security status of ffmpeg please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/ffmpeg

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS