[Git][security-tracker-team/security-tracker][master] Add new ffmpeg issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d34c1f9f by Salvatore Bonaccorso at 2026-07-25T09:23:35+02:00
Add new ffmpeg issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -16,17 +16,29 @@ CVE-2026-66337 (A flaw was found in libsoup. An unsigned integer underflow in th
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2506949
 	NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/532
 CVE-2026-66041 (FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5
 CVE-2026-66040 (FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of- ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc
 CVE-2026-66039 (FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integ ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718
 CVE-2026-66038 (FFmpeg through 8.1.2, fixed in commit 8670835, contains an information ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c
 CVE-2026-66037 (FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolle ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5
 CVE-2026-66036 (FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of- ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783
+	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c
 CVE-2026-62835 (Improper authorization in Azure Portal allows an unauthorized attacker ...)
 	NOT-FOR-US: Microsoft
 CVE-2026-61892 (Weintek cMT3092X HMI allows a non-privileged user to modify tokens to  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d34c1f9f1b9a602641d044baf8894f439b5df900

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d34c1f9f1b9a602641d044baf8894f439b5df900
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260725/f1bf1f4e/attachment.htm>