[Secure-testing-commits] r55095 - data/CVE

[Hugo Lefeuvre]

Author: hle
Date: 2017-08-25 22:57:13 +0000 (Fri, 25 Aug 2017)
New Revision: 55095

Modified:
   data/CVE/list
Log:
Mark CVE-2015-8365 as unfixed in wheezy and jessie. Add link to upstream patches for both branches.

Modified: data/CVE/list
===================================================================
--- data/CVE/list	2017-08-25 21:48:28 UTC (rev 55094)
+++ data/CVE/list	2017-08-25 22:57:13 UTC (rev 55095)
@@ -70119,8 +70119,10 @@
 CVE-2015-8365 (The smka_decode_frame function in libavcodec/smacker.c in FFmpeg ...)
 	- ffmpeg 7:2.8.3-1 (bug #806519)
 	[squeeze] - ffmpeg <end-of-life> (Not supported in Squeeze LTS)
-	- libav <undetermined>
+	- libav <unfixed>
 	NOTE: http://git.videolan.org/?p=ffmpeg.git;a=commit;h=4a9af07a49295e014b059c1ab624c40345af5892
+	NOTE: fix for the libav 11.9 branch: https://git.libav.org/?p=libav.git;a=commit;h=v11.9-5-g88762a0
+	NOTE: fix for the libav 0.8 branch: https://git.libav.org/?p=libav.git;a=commit;h=9fba59f471725e5235d5378e795ebf8b59472817
 CVE-2015-8364 (Integer overflow in the ff_ivi_init_planes function in ...)
 	- ffmpeg 7:2.8.3-1 (bug #806519)
 	[squeeze] - ffmpeg <end-of-life> (Not supported in Squeeze LTS)