CVE-2020-20892: 
Ffmpeg vulnerability analysis and mitigation

A division by zero vulnerability was discovered in function filter_frame in libavfilter/vf_lenscorrection.c in FFmpeg 4.2.1. The vulnerability is tracked as CVE-2020-20892 and was disclosed in September 2021. This vulnerability affects FFmpeg installations and could be exploited by attackers to cause a Denial of Service condition (NVD, Debian).

The vulnerability exists in the filter_frame function within the lens correction filter component of FFmpeg. It received a CVSS v3.1 Base Score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue is classified as CWE-369 (Divide By Zero) and occurs when processing video files through the lens correction filter (NVD).

When successfully exploited, this vulnerability can lead to a Denial of Service condition by causing the application to crash. The division by zero error in the lens correction filter can halt the video processing operations (NVD, Ubuntu).

The vulnerability can be triggered by processing specially crafted video files through FFmpeg's lens correction filter. A proof of concept exists demonstrating the division by zero error at libavfilter/vf_lenscorrection.c:177 (FFmpeg Ticket).

The vulnerability has been fixed in subsequent releases of FFmpeg. Users are advised to update to patched versions. Multiple Linux distributions have released security updates to address this vulnerability, including Debian and Ubuntu (Debian, Ubuntu).