[Git][security-tracker-team/security-tracker][master] Add new ffmpeg issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f701b2cc by Salvatore Bonaccorso at 2026-08-19T22:44:42+02:00
Add new ffmpeg issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -132,19 +132,40 @@ CVE-2026-75149 (marimo before 0.23.15 contains a code injection vulnerability in
 CVE-2026-75148 (cgltf through 1.15 contains an integer overflow vulnerability in the n ...)
 	NOT-FOR-US: cgltf
 CVE-2026-75147 (FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24096
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/983dae9c19f46c87d597598c0fd2f2fcee0ad2f8 (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f175bd50821f9adcded3acacc6b8e04037a92715 (n9.0.1)
 CVE-2026-75146 (FFmpeg before commit 65b0dab contains an out-of-bounds read in the DAS ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0 (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/999f8ba75ce0bf1167677de7e11a5af678fdb866 (n9.0.1)
 CVE-2026-75145 (FFmpeg before commit b4c199c contains an incorrect integer narrowing c ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24090
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b4c199c5906ff53368926c2a5839881f41957e7f (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/7646bb4c42e6837a9396c3d9ab8d8cf476e2053b (n9.0.1)
 CVE-2026-75144 (FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerabi ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818 (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1afd5c3ddafda4209e0881cd30684b919e99de7c (n9.0.1)
 CVE-2026-75143 (FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RI ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602 (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8880a174d08131f94f58a0492d1c8c6d68b74f67 (n9.0.1)
 CVE-2026-75142 (FFmpeg before commit 9d786e4 contains a stack buffer overflow in the M ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1 (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b274f0d21ba684446fd59b49e00f3f8e9ed954df (n9.0.1)
 CVE-2026-75141 (FFmpeg before commit acf5d7c contains a heap buffer overflow in the hv ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24088
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781 (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c7132ef8f63c383d11a00a9e3034748d8dd15fb3 (n9.0.1)
 CVE-2026-75114 (Joomla Extension - yootheme.com - Open redirect in CommentController:: ...)
 	NOT-FOR-US: Joomla
 CVE-2026-74804 (Joomla Extension - yootheme.com - Unauthenticated SQL injection in Ite ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f701b2cca7cae6002e9ee9d65def71be700177e0

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f701b2cca7cae6002e9ee9d65def71be700177e0
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260819/a1d25c58/attachment-0001.htm>