CVE-2020-36130: 
Linux Debian vulnerability analysis and mitigation

AOM (Alliance for Open Media) v2.0.1 was discovered to contain a NULL pointer dereference vulnerability in the component av1/av1dxiface.c. The vulnerability was assigned CVE-2020-36130 and was first recorded on January 4, 2021. This security issue affects the AV1 Video Codec Library implementation (Debian LTS, Gentoo Security).

The vulnerability is characterized by a NULL pointer dereference in the av1/av1dxiface.c component of the AOM codebase. This type of vulnerability occurs when the program attempts to read or write to memory location zero, which is not a valid memory address for program data (NVD).

If exploited, this vulnerability could lead to a denial of service condition when processing malformed multimedia files. The impact is particularly relevant when a user or automated system is tricked into opening specially crafted input files (Ubuntu Security, Debian Security).

Multiple vendors have released patches to address this vulnerability. Debian has fixed the issue in version 1.0.0-3+deb10u1 for Debian 10 (Buster) and version 1.0.0.errata1-3+deb11u1 for Debian 11 (Bullseye). For Gentoo users, the vulnerability is fixed in versions >= 3.2.0. Ubuntu 20.04 users should upgrade to version 1.0.0.errata1-3+deb11u1build0.20.04.1 (Debian Security, Gentoo Security, Ubuntu Security).