Arch Linux Security Advisory ASA-202103-7 ========================================= Severity: Medium Date : 2021-03-13 CVE-ID : CVE-2020-35964 Package : ffmpeg Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1649 Summary ======= The package ffmpeg before version 2:4.3.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2:4.3.2-1. # pacman -Syu "ffmpeg>=2:4.3.2-1" The problem has been fixed upstream in version 4.3.2. Workaround ========== None. Description =========== track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of- bounds write because of incorrect extradata packing. The issue is fixed in FFmpeg version 4.3.2. Impact ====== An attacker might be able to execute arbitrary code via a crafted media file. References ========== https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26622 https://github.com/FFmpeg/FFmpeg/commit/4f0bdff292391cdb96b79b08c56533029166... https://security.archlinux.org/CVE-2020-35964