CVE-2020-36131: 
Linux Debian vulnerability analysis and mitigation

AOM (Alliance for Open Media) v2.0.1 was discovered to contain a stack buffer overflow vulnerability in the component stats/rate_hist.c. The vulnerability was assigned CVE-2020-36131 and was initially recorded on January 4, 2021. This security issue affects the AV1 Video Codec Library implementation (CVE Mitre, Ubuntu Security).

The vulnerability has been assessed with a CVSS 3.1 base score of 8.8 (High severity). The attack vector is network-based, with low attack complexity and requires no privileges but does need user interaction. The scope is unchanged, with high impact potential across confidentiality, integrity, and availability (Ubuntu Security).

If exploited, this stack buffer overflow vulnerability could lead to denial of service or other unspecified impacts when processing malformed multimedia files (Debian Security).

Multiple distributions have released patches to address this vulnerability. Ubuntu 20.04 LTS has been fixed with version 1.0.0.errata1-3+deb11u1build0.20.04.1. Debian has addressed the issue in version 1.0.0-3+deb10u1 for Debian 10 (Buster) and version 1.0.0.errata1-3+deb11u1 for Debian 11 (Bullseye). Gentoo users should upgrade to libaom version 3.2.0 or later (Ubuntu Security Notice, Debian Security, Gentoo Security).