[Git][security-tracker-team/security-tracker][master] ffmpeg triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Fri Aug 15 10:03:46 BST 2025
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
267fe826 by Moritz Muehlenhoff at 2025-08-15T11:03:35+02:00
ffmpeg triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -8073,10 +8073,10 @@ CVE-2024-6234
CVE-2025-7700 [NULL Pointer Dereference in FFmpeg ALS Decoder (libavcodec/alsdec.c)]
- ffmpeg <unfixed>
[trixie] - ffmpeg <postponed> (Minor issue, wait until it's fixed in the 7.1 branch)
- [bookworm] - ffmpeg <postponed> (Minor issue, wait until it's fixed in the 5.1 branch)
[bullseye] - ffmpeg <postponed> (Minor issue, wait until it's fixed in the 4.3 branch)
NOTE: Introduced with: https://git.ffmpeg.org/gitweb/ffmpeg.git/object/dcfd24b10c7eaec4b7b1ec2c4abb46808721a71d
NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07
+ NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/aad4b59cfee1f0a3cf02f5e2b1f291ce013bf27e (n5.1.7)
CVE-2025-40924 (Catalyst::Plugin::Session before version 0.44 for Perl generates sessi ...)
- libcatalyst-plugin-session-perl 0.44-1 (bug #1109439)
[trixie] - libcatalyst-plugin-session-perl <no-dsa> (Minor issue)
@@ -57239,6 +57239,7 @@ CVE-2025-1594 (A vulnerability, which was classified as critical, was found in F
[bullseye] - ffmpeg <postponed> (Minor issue, wait until it's fixed upstream)
NOTE: https://ffmpeg.org/pipermail/ffmpeg-devel/2025-February/339544.html
NOTE: https://trac.ffmpeg.org/ticket/11418
+ NOTE: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/bedfb6eca402037f5cbb115fa767d106b8c14f1c
CVE-2025-1412 (Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalid ...)
- mattermost-server <itp> (bug #823556)
CVE-2024-55898 (IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user with the capability to ...)
@@ -57996,7 +57997,7 @@ CVE-2025-25474 (DCMTK v3.6.9+ DEV was discovered to contain a buffer overflow vi
CVE-2025-25473 (FFmpeg git master before commit c08d30 was discovered to contain a NUL ...)
- ffmpeg <unfixed>
[trixie] - ffmpeg <postponed> (Minor issue, wait until it's fixed in the 7.1 branch)
- [bookworm] - ffmpeg <postponed> (Minor issue, wait until it's fixed in the 5.1 branch)
+ [bookworm] - ffmpeg <not-affected> (Vulnerable code introduced later; ff_flush_packet_queue() is always called)
[bullseye] - ffmpeg <not-affected> (Vulnerable code introduced later; ff_flush_packet_queue() is always called)
NOTE: https://trac.ffmpeg.org/ticket/11419
NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/c08d300481b8ebb846cd43a473988fdbc6793d1b
@@ -58041,10 +58042,10 @@ CVE-2025-22920 (A heap buffer overflow vulnerability in FFmpeg before commit 4bf
CVE-2025-22919 (A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 ...)
{DLA-4073-1}
- ffmpeg 7:7.1.1-1
- [bookworm] - ffmpeg <postponed> (Minor issue, wait until it's fixed in the 5.1 branch)
NOTE: https://trac.ffmpeg.org/ticket/11385
NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1446e37d3d032e1452844778b3e6ba2c20f0c322
NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/145a3a84550a1c3a3b848c12a64b53c3c41d2888 (n7.1.1)
+ NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/a01eaecf6325cefab5b26e0d905df6662db37be1 (n5.1.7)
CVE-2025-22888 (Movable Type contains a stored cross-site scripting vulnerability in t ...)
- movabletype-opensource <removed>
CVE-2025-22622 (Age Verification for your checkout page. Verify your customer's identi ...)
@@ -67279,9 +67280,9 @@ CVE-2025-20072 (Mattermost Mobile versions <= 2.22.0 fail to properly validate t
CVE-2025-0518 (Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg all ...)
{DLA-4073-1}
- ffmpeg 7:7.1.1-1
- [bookworm] - ffmpeg <postponed> (Minor issue, wait until it's fixed in the 5.1 branch)
NOTE: Fixed by: https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a
NOTE: Fixed by: https://github.com/FFmpeg/FFmpeg/commit/b827ac49b770635fc666f8543cb9585e1bc6308b (n7.1.1)
+ NOTE: Fixed by: https://github.com/FFmpeg/FFmpeg/commit/edfcade702b41de4417e2597ba2aff6ecbdead0e (n5.1.7)
CVE-2025-0473 (Vulnerability in the PMB platform that allows an attacker to persist t ...)
NOT-FOR-US: PMB platform
CVE-2025-0472 (Information exposure in the PMB platform affecting versions 4.2.13 and ...)
@@ -81133,13 +81134,11 @@ CVE-2024-35369 (In FFmpeg version n6.1.1, specifically within the avcodec/speexd
CVE-2024-35368 (FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame ...)
{DLA-4039-1}
- ffmpeg 7:7.1-3
- [bookworm] - ffmpeg <postponed> (Pick up when fixed in 5.1.x)
NOTE: https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c (n7.1)
NOTE: https://github.com/ffmpeg/ffmpeg/commit/d45964ac04a83f02cb6ddc63af6d0b646c7d9082 (n5.1.7)
CVE-2024-35367 (FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_alti ...)
{DLA-4039-1}
- ffmpeg 7:7.0.1-3
- [bookworm] - ffmpeg <postponed> (Pick up when fixed in 5.1.x)
NOTE: https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667 (n7.0)
NOTE: https://github.com/FFmpeg/FFmpeg/commit/1a874e645d4a0adef9b494482fc67d12d35395cd (n5.1.7)
CVE-2024-35366 (FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the par ...)
@@ -120654,7 +120653,7 @@ CVE-2024-32229 (FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf_til
NOTE: https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a528a54ee119dcba47e7c9e30d3a56206fbad416
CVE-2024-32228 (FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavc ...)
- ffmpeg 7:7.0.1-3
- [bookworm] - ffmpeg <postponed> (Pick up when fixed in 5.1.x)
+ [bookworm] - ffmpeg <postponed> (Vulnerable code introduced later)
[bullseye] - ffmpeg <not-affected> (Vulnerable code introduced later)
NOTE: https://trac.ffmpeg.org/ticket/10951
NOTE: https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=459648761f5412acdc3317d5bac982ceaa257584
@@ -145138,10 +145137,10 @@ CVE-2023-50009 (FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow
CVE-2023-50008 (FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the c ...)
[experimental] - ffmpeg 7:7.0-1
- ffmpeg 7:7.0.1-3
- [bookworm] - ffmpeg <postponed> (Pick up when fixed in 5.1.x)
[bullseye] - ffmpeg <not-affected> (Vulnerable code not present)
[buster] - ffmpeg <not-affected> (Vulnerable code not present)
NOTE: https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b (n7.0)
+ NOTE: https://github.com/FFmpeg/FFmpeg/commit/28a7db723971c73f02ab5ad5f0a45fa288775e0a (n5.1.7)
NOTE: https://trac.ffmpeg.org/ticket/10701
CVE-2023-50007 (FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a par ...)
[experimental] - ffmpeg 7:7.0-1
@@ -145658,10 +145657,10 @@ CVE-2024-31583 (Pytorch before version v2.2.0 was discovered to contain a use-af
CVE-2024-31582 (FFmpeg version n6.1 was discovered to contain a heap buffer overflow v ...)
[experimental] - ffmpeg 7:7.0-1
- ffmpeg 7:7.0.1-3
- [bookworm] - ffmpeg <postponed> (Pick up when fixed in 5.1.x)
[bullseye] - ffmpeg <not-affected> (Vulnerable code not present)
[buster] - ffmpeg <not-affected> (Vulnerable code not present)
NOTE: Fixed by https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2 (n7.0)
+ NOTE: Fixed by https://github.com/ffmpeg/ffmpeg/commit/785a6df0e477f408c3e939a043b8608acf071964 (n5.1.7)
CVE-2024-31581 (FFmpeg version n6.1 was discovered to contain an improper validation o ...)
[experimental] - ffmpeg 7:7.0-1
- ffmpeg 7:7.0.1-3
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/267fe8269a414c42cfae434dc0b1d915f9eec198
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/267fe8269a414c42cfae434dc0b1d915f9eec198
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20250815/2535d96b/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list