CVE-2020-22028: 
Ffmpeg vulnerability analysis and mitigation

Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_vertically_8 at libavfilter/vf_avgblur.c, which could cause a remote Denial of Service. The vulnerability was discovered in 2020 and affects FFmpeg version 4.2. The issue was assigned CVE-2020-22028 and has been fixed in multiple distributions including Debian (Debian Security, Debian LTS).

The vulnerability is classified as a Buffer Overflow (CWE-120) in the filter_vertically_8 function within libavfilter/vf_avgblur.c of FFmpeg 4.2. It received a CVSS v3.1 Base Score of 6.5 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating network accessibility with required user interaction (NVD).

The primary impact of this vulnerability is the potential for remote attackers to cause a Denial of Service condition. When exploited, the buffer overflow in the filter_vertically_8 function could lead to service disruption (NVD).

The vulnerability requires user interaction to be exploited and can be triggered remotely. A proof of concept has been documented in the FFmpeg issue tracker, demonstrating the heap-buffer-overflow condition (FFmpeg Ticket).

The vulnerability has been patched in multiple versions of FFmpeg across different distributions. Debian has released security updates: version 7:4.1.8-0+deb10u1 for Debian 10 Buster and version 7:3.2.15-0+deb9u3 for Debian 9 Stretch (Debian Security, Debian LTS).