{"id":"CVE-2020-20898","aliases":["DEBIAN-CVE-2020-20898","EUVD-2020-13678","GHSA-49v3-47vp-q76c","SUSE-SU-2024:1468-1","UBUNTU-CVE-2020-20898","USN-6449-1"],"status":"published","title":"Integer Overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c in...","description":"Integer Overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01271,"percentile":0.70077,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2021-09-20T15:19:59Z","modified":"2026-10-26T12:01:43Z","fixes":[{"ecosystem":"Debian:12","package":"ffmpeg","fixed_in":["7:4.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:4.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:4.3-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","fixed_in":["7:4.2.7-0ubuntu0.1+esm3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.3-2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.11.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.2.7-0ubuntu0.1+esm3"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.11-0ubuntu0.1+esm3"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1","7:3.4.6-0ubuntu0.18.04.1","7:3.4.8-0ubuntu0.2","7:3.4.11-0ubuntu0.1","7:3.4.11-0ubuntu0.1+esm1","7:3.4.11-0ubuntu0.1+esm2"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.2.7-0ubuntu0.1+esm3"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4.2-0ubuntu0.22.04.1+esm2"}]}],"versions":["7:4.4-6ubuntu5","7:4.4.1-2ubuntu1","7:4.4.1-3ubuntu1","7:4.4.1-3ubuntu2","7:4.4.1-3ubuntu3","7:4.4.1-3ubuntu5","7:4.4.2-0ubuntu0.22.04.1","7:4.4.2-0ubuntu0.22.04.1+esm1"],"bundled":8}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"https://trac.ffmpeg.org/ticket/8263","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/99f8d32129dd233d4eb2efa44678a0bc44869f23","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Vendor Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-20898"},{"url":"https://github.com/advisories/GHSA-49v3-47vp-q76c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-20898","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241468-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190721","tags":["report"]},{"url":"https://bugzilla.suse.com/1190724","tags":["report"]},{"url":"https://bugzilla.suse.com/1190727","tags":["report"]},{"url":"https://bugzilla.suse.com/1190728","tags":["report"]},{"url":"https://bugzilla.suse.com/1190731","tags":["report"]},{"url":"https://bugzilla.suse.com/1190732","tags":["report"]},{"url":"https://bugzilla.suse.com/1223070","tags":["report"]},{"url":"https://bugzilla.suse.com/1223235","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-20894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-20898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-20900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-20901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31578","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-20898","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6449-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-20898","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-22038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-48434","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-20898","description":"Integer Overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","status":"published","published":"2021-09-20T15:19:59Z","modified":"2024-08-04T14:22:25.562Z","updated_at":"2026-11-02T14:35:45.763329Z"}],"euvd":[{"id":"EUVD-2020-13678","description":"Integer Overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","status":"published","published":"2021-09-20T15:19:59Z","modified":"2024-08-04T14:22:25Z","updated_at":"2026-11-03T03:07:24.233243Z"}],"ghsa":[{"id":"GHSA-49v3-47vp-q76c","title":"Integer Overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c in...","description":"Integer Overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","status":"published","published":"2022-05-24T19:15:16Z","modified":"2023-01-30T05:02:25Z","cwes":["CWE-190"],"updated_at":"2026-11-02T14:46:38.066268Z"}],"nvd":[{"id":"CVE-2020-20898","description":"Integer Overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","status":"published","published":"2021-09-20T16:15:09.257Z","modified":"2026-06-17T03:03:26.437Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:06:45.704484Z"}],"osv":[{"id":"CVE-2020-20898","description":"Integer Overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","status":"published","published":"2021-09-20T16:15:09.257Z","modified":"2026-11-07T13:04:34.894127095Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2020-20898","description":"Integer Overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","status":"published","published":"2021-09-20T16:15:09.257Z","modified":"2026-10-26T12:01:43.08125987Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"UBUNTU-CVE-2020-20898","description":"Integer Overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","status":"published","published":"2021-09-20T16:15:00Z","modified":"2026-04-22T12:32:41.355156Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"SUSE-SU-2024:1468-1","title":"Security update for ffmpeg","description":"This update for ffmpeg fixes the following issues:\n\n- CVE-2024-31578: Fixed heap use-after-free via av_hwframe_ctx_init() when vulkan_frames init failed (bsc#1223070)\n- CVE-2023-49502: Fixed heap buffer overflow via the ff_bwdif_filter_intra_c function in libavfilter/bwdifdsp.c (bsc#1223235)\n\nAdding references for already fixed issues:\n  \n- CVE-2021-38091: Fixed integer overflow in function filter16_sobel in libavfilter/vf_convolution.c (bsc#1190732)\n- CVE-2021-38090: Fixed integer overflow in function filter16_roberts in libavfilter/vf_convolution.c (bsc#1190731)\n- CVE-2020-20898: Fixed integer overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c (bsc#1190724)\n- CVE-2020-20901: Fixed buffer overflow vulnerability in function filter_frame in libavfilter/vf_fieldorder.c (bsc#1190728)\n- CVE-2020-20900: Fixed buffer overflow vulnerability in function gaussian_blur in libavfilter/vf_edgedetect.c (bsc#1190727)\n- CVE-2020-20894: Fixed buffer Overflow vulnerability in function gaussian_blur in libavfilter/vf_edgedetect.c (bsc#1190721)   \n","status":"published","published":"2024-04-29T15:59:01Z","modified":"2026-02-04T04:07:49.682421Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-6449-1","title":"ffmpeg vulnerabilities","description":"It was discovered that FFmpeg incorrectly managed memory resulting \nin a memory leak. An attacker could possibly use this issue to cause\na denial of service via application crash. This issue only \naffected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-22038)\n\nIt was discovered that FFmpeg incorrectly handled certain input files, \nleading to an integer overflow. An attacker could possibly use this issue\nto cause a denial of service via application crash. This issue only \naffected Ubuntu 20.04 LTS. (CVE-2020-20898, CVE-2021-38090, \nCVE-2021-38091, CVE-2021-38092, CVE-2021-38093, CVE-2021-38094)\n\nIt was discovered that FFmpeg incorrectly managed memory, resulting in\na memory leak.  If a user or automated system were tricked into \nprocessing a specially crafted input file, a remote attacker could\npossibly use this issue to cause a denial of service, or execute \narbitrary code. (CVE-2022-48434)\n","status":"published","published":"2023-10-24T10:26:27Z","modified":"2026-04-27T16:47:21.537921233Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}