ffmpeg 7:3.4.11-0ubuntu0.1: ffmpeg 7:3.4.11-0ubuntu0.1 for Ubuntu 18.04.6 LTS (bionic)

ffmpeg 7:3.4.11-0ubuntu0.1, released August 11, 2023, fixes 31 CVEs in ffmpeg. None of them is reported as exploited. Patch Radar priority: Routine. The product is no longer supported.

RoutineUnsupported product

CVEs closed

None rated Critical

Exploited

None reported

Highest CVSS

5.5

Base score, 0 to 10

Highest EPSS

0.0357

89th percentile

Priority of the 31 CVEs

Patch now 0
                                Urgent 0
                                High 0
                                Routine 31

Fixed package versions

Product	Release	Fixed in
ffmpeg	Ubuntu 18.04.6 LTS (bionic)	7:3.4.11-0ubuntu0.1

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Routine	CVE-2020-22015	ffmpeg: Buffer Overflow vulnerability in FFmpeg 4.2 in mov_write_video_tag due to the out of bounds in libavformat/movenc.c,...	n/a	0.0357	None reported
Routine	CVE-2021-38291	ffmpeg: Fixed an assertion failure at src/libavutil/mathematics.c (bsc#1189428)	n/a	0.0269	None reported
Routine	CVE-2021-38171	ffmpeg: adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is...	n/a	0.0241	None reported
Routine	CVE-2020-35965	ffmpeg: decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when...	n/a	0.0231	None reported
Routine	CVE-2020-21041	ffmpeg: Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng_do_inverse_blend in libavcodec/pngenc.c, which could let...	n/a	0.0207	None reported
Routine	CVE-2020-22025	ffmpeg: A heap-based Buffer Overflow vulnerability exists in gaussian_blur at libavfilter/vf_edgedetect.c, which might lead t...	n/a	0.0184	None reported
Routine	CVE-2020-22032	ffmpeg: A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_edgedetect.c in gaussian_blur, which m...	n/a	0.0184	None reported
Routine	CVE-2020-20453	ffmpeg: FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aaccoder, which allows a remote malicious user to cau...	n/a	0.0178	None reported
Routine	CVE-2020-21688	ffmpeg: A heap-use-after-free in the av_freep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary...	n/a	0.0173	None reported
Routine	CVE-2020-20446	ffmpeg: FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious user to cau...	n/a	0.0173	None reported
Routine	CVE-2020-22036	ffmpeg: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_intra at libavfilter/vf_bwdif.c, which migh...	n/a	0.0173	None reported
Routine	CVE-2020-22028	ffmpeg: Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_vertically_8 at libavfilter/vf_avgblur.c, which could ca...	n/a	0.0171	None reported
Routine	CVE-2020-22031	ffmpeg: A Heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_w3fdif.c in filter16_complex_low, w...	n/a	0.0169	None reported
Routine	CVE-2020-22021	ffmpeg-4: Fixed Buffer Overflow vulnerability in filter_edges function in libavfilter/vf_yadif.c (bsc#1186586)	n/a	0.0168	None reported
Routine	CVE-2020-20445	ffmpeg: FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious user to cause...	n/a	0.0165	None reported
Routine	CVE-2020-22034	ffmpeg: A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_floodfill.c, which might lead to memor...	n/a	0.0162	None reported
Routine	CVE-2020-22016	ffmpeg: A heap-based Buffer Overflow vulnerability in FFmpeg 4.2 at libavcodec/get_bits.h when writing .mov files, which migh...	n/a	0.0161	None reported
Routine	CVE-2020-22022	ffmpeg: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_fieldorder.c, which...	n/a	0.0161	None reported
Routine	CVE-2020-22037	libavcodec-extra57: A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodec_alloc_context3 at options.c.	n/a	0.0160	None reported
Routine	CVE-2020-22020	ffmpeg: Buffer Overflow vulnerability in FFmpeg 4.2 in the build_diff_map function in libavfilter/vf_fieldmatch.c, which coul...	n/a	0.0152	None reported
Routine	CVE-2020-22033	ffmpeg: A heap-based Buffer Overflow Vulnerability exists FFmpeg 4.2 at libavfilter/vf_vmafmotion.c in convolution_y_8bit, wh...	n/a	0.0150	None reported
Routine	CVE-2020-22023	ffmpeg: A heap-based Buffer Overflow vulnerabililty exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_bitplanenoise.c, w...	n/a	0.0146	None reported
Routine	CVE-2020-22017	ffmpeg: A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at ff_fill_rectangle in libavfilter/drawutils.c, whic...	n/a	0.0143	None reported
Routine	CVE-2020-22026	ffmpeg: Buffer Overflow vulnerability exists in FFmpeg 4.2 in the config_input function at libavfilter/af_tremolo.c, which co...	n/a	0.0137	None reported
Routine	CVE-2020-20451	libavutil56: Denial of Service issue in FFmpeg 4.2 due to resource management errors via fftools/cmdutils.c.	n/a	0.0135	None reported

Also fixes CVE-2020-22015

ffmpeg 7:4.2.7-0ubuntu0.1
ffmpeg on Ubuntu 20.04 LTS (focal)
libavcodec-extra 7:4.2.7-0ubuntu0.1
libavcodec-extra on Ubuntu 20.04 LTS (focal)
libavcodec-extra58 7:4.2.7-0ubuntu0.1
libavcodec-extra58 on Ubuntu 20.04 LTS (focal)
libavcodec58 7:4.2.7-0ubuntu0.1
libavcodec58 on Ubuntu 20.04 LTS (focal)
libavdevice58 7:4.2.7-0ubuntu0.1
libavdevice58 on Ubuntu 20.04 LTS (focal)
libavfilter-extra 7:4.2.7-0ubuntu0.1
libavfilter-extra on Ubuntu 20.04 LTS (focal)
libavfilter-extra7 7:4.2.7-0ubuntu0.1
libavfilter-extra7 on Ubuntu 20.04 LTS (focal)
libavfilter7 7:4.2.7-0ubuntu0.1
libavfilter7 on Ubuntu 20.04 LTS (focal)

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/ubuntu-bionic-ffmpeg-7-3.4.11-0ubuntu0.1">ffmpeg 7:3.4.11-0ubuntu0.1 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.