{"schema_version":"1.7.2","id":"OESA-2026-2595","modified":"2026-08-06T11:11:32Z","published":"2026-06-05T11:11:32Z","upstream":["CVE-2020-20450","CVE-2020-20451","CVE-2020-22017","CVE-2020-22022","CVE-2020-22025","CVE-2020-22029","CVE-2020-22030"],"summary":"ffmpeg security update","details":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nFFmpeg 4.2 is affected by null pointer dereference passed as argument to libavformat/aviobuf.c, which could cause a Denial of Service.(CVE-2020-20450)\n\nDenial of Service issue in FFmpeg 4.2 due to resource management errors via fftools/cmdutils.c.(CVE-2020-20451)\n\nA heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at ff_fill_rectangle in libavfilter/drawutils.c, which might lead to memory corruption and other potential consequences.(CVE-2020-22017)\n\nA heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_fieldorder.c, which might lead to memory corruption and other potential consequences.(CVE-2020-22022)\n\nA heap-based Buffer Overflow vulnerability exists in gaussian_blur at libavfilter/vf_edgedetect.c, which might lead to memory corruption and other potential consequences.(CVE-2020-22025)\n\nA heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_colorconstancy.c: in slice_get_derivative, which crossfade_samples_fltp, which might lead to memory corruption and other potential consequences.(CVE-2020-22029)\n\nA heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/af_afade.c in crossfade_samples_fltp, which might lead to memory corruption and other potential consequences.(CVE-2020-22030)","affected":[{"package":{"ecosystem":"openEuler:20.03-LTS-SP4","name":"ffmpeg","purl":"pkg:rpm/openEuler/ffmpeg&distro=openEuler-20.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-31.oe2003sp4"}]}],"ecosystem_specific":{"aarch64":["ffmpeg-4.2.4-31.oe2003sp4.aarch64.rpm","ffmpeg-debuginfo-4.2.4-31.oe2003sp4.aarch64.rpm","ffmpeg-debugsource-4.2.4-31.oe2003sp4.aarch64.rpm","ffmpeg-devel-4.2.4-31.oe2003sp4.aarch64.rpm","ffmpeg-libs-4.2.4-31.oe2003sp4.aarch64.rpm","libavdevice-4.2.4-31.oe2003sp4.aarch64.rpm"],"src":["ffmpeg-4.2.4-31.oe2003sp4.src.rpm"],"x86_64":["ffmpeg-4.2.4-31.oe2003sp4.x86_64.rpm","ffmpeg-debuginfo-4.2.4-31.oe2003sp4.x86_64.rpm","ffmpeg-debugsource-4.2.4-31.oe2003sp4.x86_64.rpm","ffmpeg-devel-4.2.4-31.oe2003sp4.x86_64.rpm","ffmpeg-libs-4.2.4-31.oe2003sp4.x86_64.rpm","libavdevice-4.2.4-31.oe2003sp4.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2595"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-20450"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-20451"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-22017"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-22022"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-22025"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-22029"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-22030"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"database_specific":{"severity":"High"}}