{"id":"CVE-2020-20899","aliases":["EUVD-2020-13679","GHSA-4hv4-q965-54rg","SUSE-SU-2021:3521-1","SUSE-SU-2023:0005-1","UBUNTU-CVE-2020-20899","openSUSE-SU-2021:3521-1"],"status":"rejected","title":"Buffer Overflow vulnerability in function config_props in libavfilter/vf_bwdif.c in Ffmpeg 4.2.1,...","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22036. Reason: This candidate is a duplicate of CVE-2020-22036. Notes: All CVE users should reference CVE-2020-22036 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-120"],"published":"2021-09-20T15:19:59Z","modified":"2026-02-04T04:37:04Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-11.17.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-11.17.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-11.17.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-11.17.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP2","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-11.17.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-11.17.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150000.4.44.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150000.4.44.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150000.4.44.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150000.4.44.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150000.4.44.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150000.4.44.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150000.4.44.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150000.4.44.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150000.4.44.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150000.4.44.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-11.17.1"}]}],"bundled":12}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-20899"},{"url":"https://trac.ffmpeg.org/ticket/8261","tags":["report"]},{"url":"http://git.videolan.org/?p=ffmpeg.git;a=commit;h=8c3166e1c302c3ba80d9742ae46161c0fa8e2606","tags":["report"]},{"url":"https://github.com/advisories/GHSA-4hv4-q965-54rg"},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213521-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186756","tags":["report"]},{"url":"https://bugzilla.suse.com/1187852","tags":["report"]},{"url":"https://bugzilla.suse.com/1189166","tags":["report"]},{"url":"https://bugzilla.suse.com/1190718","tags":["report"]},{"url":"https://bugzilla.suse.com/1190719","tags":["report"]},{"url":"https://bugzilla.suse.com/1190722","tags":["report"]},{"url":"https://bugzilla.suse.com/1190723","tags":["report"]},{"url":"https://bugzilla.suse.com/1190726","tags":["report"]},{"url":"https://bugzilla.suse.com/1190729","tags":["report"]},{"url":"https://bugzilla.suse.com/1190733","tags":["report"]},{"url":"https://bugzilla.suse.com/1190734","tags":["report"]},{"url":"https://bugzilla.suse.com/1190735","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-20891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-20892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-20895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-20896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-20899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-20902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-22037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38094","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230005-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186761","tags":["report"]},{"url":"https://bugzilla.suse.com/1206442","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-22042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3109","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-20899","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-20899","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HVCB2YATP2LRWUBIGFYZQUFV52VSFT2B/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-20899","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22036. Reason: This candidate is a duplicate of CVE-2020-22036. Notes: All CVE users should reference CVE-2020-22036 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2021-09-20T15:19:59Z","modified":"2021-09-27T15:51:12Z","updated_at":"2026-11-02T14:35:45.763329Z"}],"euvd":[{"id":"EUVD-2020-13679","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22036. Reason: This candidate is a duplicate of CVE-2020-22036. Notes: All CVE users should reference CVE-2020-22036 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"published","published":"2021-09-20T15:19:59Z","modified":"2021-09-27T15:51:12Z","updated_at":"2026-11-03T03:51:13.624059Z"}],"ghsa":[{"id":"GHSA-4hv4-q965-54rg","title":"Buffer Overflow vulnerability in function config_props in libavfilter/vf_bwdif.c in Ffmpeg 4.2.1,...","description":"Buffer Overflow vulnerability in function config_props in libavfilter/vf_bwdif.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts.","status":"published","published":"2022-05-24T19:15:16Z","modified":"2023-01-30T05:02:16Z","cwes":["CWE-120"],"updated_at":"2026-11-02T14:46:36.123786Z"}],"nvd":[{"id":"CVE-2020-20899","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22036. Reason: This candidate is a duplicate of CVE-2020-22036. Notes: All CVE users should reference CVE-2020-22036 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2021-09-20T16:15:09.303Z","modified":"2023-11-07T03:19:42.55Z","updated_at":"2026-11-02T14:06:45.704484Z"}],"osv":[{"id":"openSUSE-SU-2021:3521-1","title":"Security update for ffmpeg","description":"This update for ffmpeg fixes the following issues:\n\n- CVE-2021-3566: Fixed information leak (bsc#1189166).\n- CVE-2021-38093: Fixed integer overflow vulnerability in filter_robert() (bsc#1190734)\n- CVE-2021-38092: Fixed integer overflow vulnerability in filter_prewitt() (bsc#1190733)\n- CVE-2021-38094: Fixed integer overflow vulnerability in filter_sobel() (bsc#1190735)\n- CVE-2020-22037: Fixed denial of service vulnerability caused by memory leak in avcodec_alloc_context3() (bsc#1186756)\n- CVE-2020-35965: Fixed out-of-bounds write in decode_frame() (bsc#1187852)\n- CVE-2020-20892: Fixed an issue with filter_frame() (bsc#1190719)\n- CVE-2020-20891: Fixed a buffer overflow vulnerability in config_input() (bsc#1190718)\n- CVE-2020-20895: Fixed a buffer overflow vulnerability in function filter_vertically_##name (bsc#1190722)\n- CVE-2020-20896: Fixed an issue with latm_write_packet() (bsc#1190723)\n- CVE-2020-20899: Fixed a buffer overflow vulnerability in config_props() (bsc#1190726)\n- CVE-2020-20902: Fixed an out-of-bounds read vulnerabilit long_term_filter() (bsc#1190729)\n","status":"published","published":"2021-10-26T13:39:27Z","modified":"2026-02-04T04:37:04.307457Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"SUSE-SU-2021:3521-1","title":"Security update for ffmpeg","description":"This update for ffmpeg fixes the following issues:\n\n- CVE-2021-3566: Fixed information leak (bsc#1189166).\n- CVE-2021-38093: Fixed integer overflow vulnerability in filter_robert() (bsc#1190734)\n- CVE-2021-38092: Fixed integer overflow vulnerability in filter_prewitt() (bsc#1190733)\n- CVE-2021-38094: Fixed integer overflow vulnerability in filter_sobel() (bsc#1190735)\n- CVE-2020-22037: Fixed denial of service vulnerability caused by memory leak in avcodec_alloc_context3() (bsc#1186756)\n- CVE-2020-35965: Fixed out-of-bounds write in decode_frame() (bsc#1187852)\n- CVE-2020-20892: Fixed an issue with filter_frame() (bsc#1190719)\n- CVE-2020-20891: Fixed a buffer overflow vulnerability in config_input() (bsc#1190718)\n- CVE-2020-20895: Fixed a buffer overflow vulnerability in function filter_vertically_##name (bsc#1190722)\n- CVE-2020-20896: Fixed an issue with latm_write_packet() (bsc#1190723)\n- CVE-2020-20899: Fixed a buffer overflow vulnerability in config_props() (bsc#1190726)\n- CVE-2020-20902: Fixed an out-of-bounds read vulnerabilit long_term_filter() (bsc#1190729)\n","status":"published","published":"2021-10-26T13:39:26Z","modified":"2026-02-04T03:01:13.927489Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2023:0005-1","title":"Security update for ffmpeg","description":"This update for ffmpeg fixes the following issues:\n\n- CVE-2022-3109: Fixed null pointer dereference in vp3_decode_frame() (bsc#1206442).\n- CVE-2020-22042: Fixed a denial of service vulnerability led by a memory leak in the link_filter_inouts function in libavfilter/graphparser.c. (bsc#1186761)\n- CVE-2021-38094: Fixed an integer overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c (bsc#1190735).\n- CVE-2021-38093: Fixed an integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c (bsc#1190734).\n- CVE-2021-38092: Fixed an Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c (bsc#1190733).\n- CVE-2020-22037: Fixed a denial of service vulnerability due to a memory leak in avcodec_alloc_context3 at options.c (bsc#1186756).\n- CVE-2021-3566: Fixed an exposure of sensitive information on ffmpeg version prior to 4.3 (bsc#1189166).\n- CVE-2020-35965: Fixed an out-of-bounds write in decode_frame in libavcodec/exr.c (bsc#1187852).\n- CVE-2020-20892: Fixed a division by zero in function filter_frame in libavfilter/vf_lenscorrection.c (bsc#1190719).\n- CVE-2020-20891: Fixed a buffer overflow vulnerability in function config_input in libavfilter/vf_gblur.c (bsc#1190718).\n- CVE-2020-20895: Fixed a buffer overflow vulnerability in function filter_vertically_##name in libavfilter/vf_avgblur.c (bsc#1190722).\n- CVE-2020-20896: Fixed a NULL pointer dereference in function latm_write_packet in libavformat/latmenc.c (bsc#1190723).\n- CVE-2020-20899: Fixed a buffer overflow vulnerability in function config_props in libavfilter/vf_bwdif.c (bsc#1190726).\n- CVE-2020-20902: Fixed an out-of-bounds read vulnerability in long_term_filter function in g729postfilter.c (bsc#1190729).\n","status":"published","published":"2023-01-02T10:39:08Z","modified":"2026-02-04T04:15:17.492211Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"UBUNTU-CVE-2020-20899","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22036. Reason: This candidate is a duplicate of CVE-2020-22036. Notes: All CVE users should reference CVE-2020-22036 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.","status":"withdrawn","published":"2021-09-20T16:15:00Z","modified":"2025-08-01T04:52:26Z","updated_at":"2026-11-02T15:54:23.905183Z"}]}}