CVE-2020-20899
Buffer Overflow vulnerability in function config_props in libavfilter/vf_bwdif.c in Ffmpeg 4.2.1,...
CVE-2020-20899 has been rejected by its source and should not be treated as a live vulnerability, published September 20, 2021.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22036. Reason: This candidate is a duplicate of CVE-2020-22036. Notes: All CVE users should reference CVE-2020-22036 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegSUSE:Linux Enterprise Module for Desktop Applications 15 SP2 From an advisory covering 12 CVEs | before 3.4.2-11.17.1 | 3.4.2-11.17.1 |
ffmpegSUSE:Linux Enterprise Module for Desktop Applications 15 SP3 From an advisory covering 12 CVEs | before 3.4.2-11.17.1 | 3.4.2-11.17.1 |
ffmpegSUSE:Linux Enterprise Module for Package Hub 15 SP2 From an advisory covering 12 CVEs | before 3.4.2-11.17.1 | 3.4.2-11.17.1 |
ffmpegSUSE:Linux Enterprise Module for Package Hub 15 SP3 From an advisory covering 12 CVEs | before 3.4.2-11.17.1 | 3.4.2-11.17.1 |
ffmpegSUSE:Linux Enterprise Workstation Extension 15 SP2 From an advisory covering 12 CVEs | before 3.4.2-11.17.1 | 3.4.2-11.17.1 |
ffmpegSUSE:Linux Enterprise Workstation Extension 15 SP3 From an advisory covering 12 CVEs | before 3.4.2-11.17.1 | 3.4.2-11.17.1 |
ffmpegSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 14 CVEs | before 3.4.2-150000.4.44.1 | 3.4.2-150000.4.44.1 |
ffmpegSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 14 CVEs | before 3.4.2-150000.4.44.1 | 3.4.2-150000.4.44.1 |
ffmpegSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 14 CVEs | before 3.4.2-150000.4.44.1 | 3.4.2-150000.4.44.1 |
ffmpegSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 14 CVEs | before 3.4.2-150000.4.44.1 | 3.4.2-150000.4.44.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ffmpegSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 14 CVEs | before 3.4.2-150000.4.44.1 | 3.4.2-150000.4.44.1 |
ffmpegSUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 14 CVEs | before 3.4.2-150000.4.44.1 | 3.4.2-150000.4.44.1 |
ffmpegSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 14 CVEs | before 3.4.2-150000.4.44.1 | 3.4.2-150000.4.44.1 |
ffmpegSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 14 CVEs | before 3.4.2-150000.4.44.1 | 3.4.2-150000.4.44.1 |
ffmpegSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 14 CVEs | before 3.4.2-150000.4.44.1 | 3.4.2-150000.4.44.1 |
ffmpegSUSE:Enterprise Storage 6 From an advisory covering 14 CVEs | before 3.4.2-150000.4.44.1 | 3.4.2-150000.4.44.1 |
ffmpegopenSUSE:Leap 15.3 From an advisory covering 12 CVEs | before 3.4.2-11.17.1 | 3.4.2-11.17.1 |
What each source reports
CVE ListNo score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22036. Reason: This candidate is a duplicate of CVE-2020-22036. Notes: All CVE users should reference CVE-2020-22036 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
CVE-2020-20899- Updated
- 2026-11-02
EUVDEUVD-2020-13679No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22036. Reason: This candidate is a duplicate of CVE-2020-22036. Notes: All CVE users should reference CVE-2020-22036 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
EUVD-2020-13679- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4hv4-q965-54rgNo score
Buffer Overflow vulnerability in function config_props in libavfilter/vf_bwdif.c in Ffmpeg 4.2.1,...
Buffer Overflow vulnerability in function config_props in libavfilter/vf_bwdif.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.
- Record
GHSA-4hv4-q965-54rg- Weakness
- CWE-120
- Updated
- 2026-11-02
NVDNo score
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22036. Reason: This candidate is a duplicate of CVE-2020-22036. Notes: All CVE users should reference CVE-2020-22036 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
CVE-2020-20899- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:3521-1No score
Security update for ffmpeg
This update for ffmpeg fixes the following issues:
- CVE-2021-3566: Fixed information leak (bsc#1189166).
- CVE-2021-38093: Fixed integer overflow vulnerability in filter_robert() (bsc#1190734)
- CVE-2021-38092: Fixed integer overflow vulnerability in filter_prewitt() (bsc#1190733)
- CVE-2021-38094: Fixed integer overflow vulnerability in filter_sobel() (bsc#1190735)
- CVE-2020-22037: Fixed denial of service vulnerability caused by memory leak in avcodec_alloc_context3() (bsc#1186756)
- CVE-2020-35965: Fixed out-of-bounds write in decode_frame() (bsc#1187852)
- CVE-2020-20892: Fixed an issue with filter_frame() (bsc#1190719)
- CVE-2020-20891: Fixed a buffer overflow vulnerability in config_input() (bsc#1190718)
- CVE-2020-20895: Fixed a buffer overflow vulnerability in function filter_vertically_##name (bsc#1190722)
- CVE-2020-20896: Fixed an issue with latm_write_packet() (bsc#1190723)
- CVE-2020-20899: Fixed a buffer overflow vulnerability in config_props() (bsc#1190726)
- CVE-2020-20902: Fixed an out-of-bounds read vulnerabilit long_term_filter() (bsc#1190729)
- Record
openSUSE-SU-2021:3521-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3521-1No score
Security update for ffmpeg
This update for ffmpeg fixes the following issues:
- CVE-2021-3566: Fixed information leak (bsc#1189166).
- CVE-2021-38093: Fixed integer overflow vulnerability in filter_robert() (bsc#1190734)
- CVE-2021-38092: Fixed integer overflow vulnerability in filter_prewitt() (bsc#1190733)
- CVE-2021-38094: Fixed integer overflow vulnerability in filter_sobel() (bsc#1190735)
- CVE-2020-22037: Fixed denial of service vulnerability caused by memory leak in avcodec_alloc_context3() (bsc#1186756)
- CVE-2020-35965: Fixed out-of-bounds write in decode_frame() (bsc#1187852)
- CVE-2020-20892: Fixed an issue with filter_frame() (bsc#1190719)
- CVE-2020-20891: Fixed a buffer overflow vulnerability in config_input() (bsc#1190718)
- CVE-2020-20895: Fixed a buffer overflow vulnerability in function filter_vertically_##name (bsc#1190722)
- CVE-2020-20896: Fixed an issue with latm_write_packet() (bsc#1190723)
- CVE-2020-20899: Fixed a buffer overflow vulnerability in config_props() (bsc#1190726)
- CVE-2020-20902: Fixed an out-of-bounds read vulnerabilit long_term_filter() (bsc#1190729)
- Record
SUSE-SU-2021:3521-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:0005-1No score
Security update for ffmpeg
This update for ffmpeg fixes the following issues:
- CVE-2022-3109: Fixed null pointer dereference in vp3_decode_frame() (bsc#1206442).
- CVE-2020-22042: Fixed a denial of service vulnerability led by a memory leak in the link_filter_inouts function in libavfilter/graphparser.c. (bsc#1186761)
- CVE-2021-38094: Fixed an integer overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c (bsc#1190735).
- CVE-2021-38093: Fixed an integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c (bsc#1190734).
- CVE-2021-38092: Fixed an Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c (bsc#1190733).
- CVE-2020-22037: Fixed a denial of service vulnerability due to a memory leak in avcodec_alloc_context3 at options.c (bsc#1186756).
- CVE-2021-3566: Fixed an exposure of sensitive information on ffmpeg version prior to 4.3 (bsc#1189166).
- CVE-2020-35965: Fixed an out-of-bounds write in decode_frame in libavcodec/exr.c (bsc#1187852).
- CVE-2020-20892: Fixed a division by zero in function filter_frame in libavfilter/vf_lenscorrection.c (bsc#1190719).
- CVE-2020-20891: Fixed a buffer overflow vulnerability in function config_input in libavfilter/vf_gblur.c (bsc#1190718).
- CVE-2020-20895: Fixed a buffer overflow vulnerability in function filter_vertically_##name in libavfilter/vf_avgblur.c (bsc#1190722).
- CVE-2020-20896: Fixed a NULL pointer dereference in function latm_write_packet in libavformat/latmenc.c (bsc#1190723).
- CVE-2020-20899: Fixed a buffer overflow vulnerability in function config_props in libavfilter/vf_bwdif.c (bsc#1190726).
- CVE-2020-20902: Fixed an out-of-bounds read vulnerability in long_term_filter function in g729postfilter.c (bsc#1190729).
- Record
SUSE-SU-2023:0005-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-20899No score
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22036. Reason: This candidate is a duplicate of CVE-2020-22036. Notes: All CVE users should reference CVE-2020-22036 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
- Record
UBUNTU-CVE-2020-20899- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
nvd.nist.gov/vuln/detail/CVE-2020-20899
trac.ffmpeg.org/ticket/8261
git.videolan.org?p=ffmpeg.git;a=commit;h=8c3166e1c302c3ba80d9742ae46161c0fa8e2606
github.com/advisories/GHSA-4hv4-q965-54rg
suse.com/support/update/announcement/2021/suse-su-20213521-1
bugzilla.suse.com/1186756
Show 31 moreShow less
ubuntu.com/security/CVE-2020-20899
cve.org/CVERecord?id=CVE-2020-20899
lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HVCB2YATP2LRWUBIGFYZQUFV52VSFT2B