Bug 1190721 – VUL-0: CVE-2020-20894: ffmpeg: Buffer Overflow vulnerability in function gaussian_blur in libavfilter/vf_edgedetect.c

Bug 1190721 - (CVE-2020-20894) VUL-0: CVE-2020-20894: ffmpeg: Buffer Overflow vulnerability in function gaussian_blur in libavfilter/vf_edgedetect.c

(CVE-2020-20894)
Summary:	VUL-0: CVE-2020-20894: ffmpeg: Buffer Overflow vulnerability in function gaus...

Status:	NEW

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Alynx Zhou
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/310567/
Whiteboard:	CVSSv3.1:SUSE:CVE-2020-20894:6.5:(AV:...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2021-09-21 14:01 UTC by Alexander Bergmann
Modified:	2022-01-11 14:34 UTC (History)
CC List:	5 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Flags:	abergmann: needinfo? (alynx.zhou)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Alexander Bergmann 2021-09-21 14:01:24 UTC

CVE-2020-20894

Buffer Overflow vulnerability in function gaussian_blur in
libavfilter/vf_edgedetect.c in Ffmpeg 4.2.1, allows attackers to cause a Denial
of Service or other unspecified impacts.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-20894
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-20894
https://trac.ffmpeg.org/ticket/8260
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/ccf4ab8c9aca0aee66bcc2914031a9c97ac0eeb8

Comment 1 Alexander Bergmann 2021-09-22 13:59:56 UTC

This commit is already present in our 3.4.2 version, but has a different CVE.

bsc#1186605 - CVE-2020-22025

We should correct the changes entry and follow up on CVE-2020-22025.

Comment 2 Alynx Zhou 2021-10-13 08:39:53 UTC

(In reply to Alexander Bergmann from comment #1)
> This commit is already present in our 3.4.2 version, but has a different CVE.
> 
> bsc#1186605 - CVE-2020-22025
> 
> We should correct the changes entry and follow up on CVE-2020-22025.

Those bugs share the same ticket number (#8260).

Comment 3 Alexander Bergmann 2022-01-11 14:34:21 UTC

We need the bug and CVE references of this bug inside the changes file so we can track that it is fixed.

Please extend the following entry with the bsc#/CVE details.

- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).