[Git][security-tracker-team/security-tracker][master] Add new ffmpeg issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b83968c7 by Salvatore Bonaccorso at 2026-07-22T22:24:12+02:00
Add new ffmpeg issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -47,17 +47,29 @@ CVE-2026-65012 (InvokeAI before 6.13.7 contains an unauthenticated directory enu
 CVE-2026-65011 (Graylog2 Server before commit 46a2eeb contains a missing per-entity pe ...)
 	- graylog2 <itp> (bug #652273)
 CVE-2026-64835 (FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory acce ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e
 CVE-2026-64834 (FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerabi ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632
 CVE-2026-64833 (FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vuln ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4
 CVE-2026-64832 (FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability  ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97
 CVE-2026-64831 (FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vul ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed
 CVE-2026-64830 (FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vuln ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951
 CVE-2026-64828 (Froiden TableTrack through 1.3.10 contains a stored cross-site scripti ...)
 	NOT-FOR-US: Froiden TableTrack
 CVE-2026-63264 (The Joomla extension JoomShopping is vulnerable to an reflected XSS vu ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b83968c707d922e81fdb8f96e618968a199c016c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b83968c707d922e81fdb8f96e618968a199c016c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260722/91e48ae8/attachment.htm>