CVE-2020-13904

2020-06-0719:15:09

Google

osv.dev

6.6 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

52.8%

JSON

FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in av_probe_input_format3 in libavformat/format.c.

CPENameOperatorVersion
ffmpeg.giteqn2.8-de
ffmpeg.giteqn2.8.16
ffmpeg.giteqn2.8.3
ffmpeg.giteqn1.3-de
ffmpeg.giteqn2.2-de
ffmpeg.giteqn2.8.13
ffmpeg.giteqn0.8
ffmpeg.giteqn2.7-de
ffmpeg.giteqn2.8.11
ffmpeg.giteqn2.0

Name	Operator	Version
ffmpeg.git	eq	n2.8-de
ffmpeg.git	eq	n2.8.16
ffmpeg.git	eq	n2.8.3
ffmpeg.git	eq	n1.3-de
ffmpeg.git	eq	n2.2-de
ffmpeg.git	eq	n2.8.13
ffmpeg.git	eq	n0.8
ffmpeg.git	eq	n2.7-de
ffmpeg.git	eq	n2.8.11
ffmpeg.git	eq	n2.0