CVE-2020-23906: 
Ffmpeg vulnerability analysis and mitigation

FFmpeg N-98388-g76a3ee996b contains a denial of service (DoS) vulnerability that allows attackers to cause a system crash via a crafted audio file due to insufficient verification of data authenticity (Debian Security, FFmpeg Ticket). The vulnerability was introduced in commit e045be92cdf5a2851900e8e85b815c29ae6f100a and later fixed in commit ec59dc73f0cc8930bf5dae389cd76d049d537ca7.

The vulnerability exists in the 4xm file format codec parsing functionality. When processing certain malformed audio files, the application aborts due to improper validation of data authenticity. The issue was discovered through AFL fuzzing of the 4xm fileformat codec (FFmpeg Ticket).

When exploited, the vulnerability allows attackers to cause a denial of service condition by causing the application to abort during file parsing operations. This can affect the availability of systems using the vulnerable FFmpeg versions (Debian Security).

The vulnerability has been fixed in FFmpeg commit ec59dc73f0cc8930bf5dae389cd76d049d537ca7. Users should upgrade to a version containing this fix. For Debian systems, fixed versions are available in bullseye (7:4.3.7-0+deb11u1), bullseye security (7:4.3.8-0+deb11u3), and later releases (Debian Security).