FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because     dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted. (CVE-2020-14212)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because
    dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted. (CVE-2020-14212)

The remote host is affected by the vulnerability described in GLSA-202007-58 (FFmpeg: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FFmpeg. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
250620	Linux Distros Unpatched Vulnerability : CVE-2020-14212	Nessus	Misc.	high
426310	Alpine: ffmpeg4: security update to 4.3.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426310	Alpine: ffmpeg4: security update to 4.3.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404322	Alpine: multiple ffmpeg packages: security update to 4.3.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404322	Alpine: multiple ffmpeg packages: security update to 4.3.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
139121	GLSA-202007-58 : FFmpeg: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2020-14212

high

Tenable Plugins

high

high

high

high

high

critical