CVE-2020-35964: 
Ffmpeg vulnerability analysis and mitigation

CVE-2020-35964 affects FFmpeg version 4.3.1, specifically the track_header function in libavformat/vividas.c component. The vulnerability was discovered and disclosed on January 3, 2021. The issue involves an out-of-bounds write vulnerability that occurs due to incorrect extradata packing (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The issue is classified as CWE-787 (Out-of-bounds Write). The vulnerability specifically affects the track_header function's handling of extradata packing in the vividas.c file (NVD).

The vulnerability primarily affects system availability, with no direct impact on confidentiality or integrity. If successfully exploited, it could lead to a system crash or service disruption due to the out-of-bounds write condition (Ubuntu).

The vulnerability requires network access and user interaction to exploit. While the attack complexity is considered low, successful exploitation depends on a user interacting with malicious content. The vulnerability was discovered through the OSS-Fuzz continuous fuzzing process (Chromium).

A fix has been released in subsequent versions of FFmpeg. Users are advised to upgrade to FFmpeg version 4.4 or later. The patch improves extradata packing checks in the track_header function. For Gentoo Linux users, the recommendation is to upgrade using 'emerge --ask --oneshot --verbose ">=media-video/ffmpeg-4.4"' (Gentoo, FFmpeg Patch).