[Git][security-tracker-team/security-tracker][master] ffmpeg DSA

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
2b0d62e3 by Moritz Mühlenhoff at 2026-06-22T21:24:30+02:00
ffmpeg DSA

- - - - -


3 changed files:

- data/CVE/list
- data/DSA/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -44773,7 +44773,6 @@ CVE-2026-30998 (An improper resource deallocation and closure vulnerability in t
 	NOTE: Bogus CVE assignment for ffmpeg, gets cleaned up by the OS anyway
 CVE-2026-30997 (An out-of-bounds read in the read_global_param() function (libavcodec/ ...)
 	- ffmpeg <unfixed>
-	[trixie] - ffmpeg <postponed> (Minor issue, wait until it's fixed in the 7.1 branch)
 	[bookworm] - ffmpeg <postponed> (Minor issue, wait until it's fixed in the 5.1 branch)
 	[bullseye] - ffmpeg <postponed> (Minor issue)
 	NOTE: https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f
@@ -202505,7 +202504,6 @@ CVE-2025-24841 (Movable Type contains a stored cross-site scripting vulnerabilit
 CVE-2025-22921 (FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a seg ...)
 	{DLA-4073-1}
 	- ffmpeg 7:8.0.1-2
-	[trixie] - ffmpeg <postponed> (Minor issue, wait until it's fixed in the 7.1 branch)
 	[bookworm] - ffmpeg <postponed> (Minor issue, wait until it's fixed in the 5.1 branch)
 	NOTE: https://trac.ffmpeg.org/ticket/11393
 	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/7f9c7f9849a2155224711f0ff57ecdac6e4bfb57 (n8.0)


=====================================
data/DSA/list
=====================================
@@ -1,3 +1,6 @@
+[22 Jun 2026] DSA-6361-1 ffmpeg - security update
+	{CVE-2025-22921 CVE-2026-8461 CVE-2026-30997}
+	[trixie] - ffmpeg 7:7.1.5-0+deb13u1
 [21 Jun 2026] DSA-6360-1 squid - security update
 	{CVE-2026-33515 CVE-2026-33526 CVE-2026-47729 CVE-2026-50012}
 	[trixie] - squid 6.13-2+deb13u2


=====================================
data/dsa-needed.txt
=====================================
@@ -30,9 +30,6 @@ expat (aron)
 --
 fastnetmon (jmm)
 --
-ffmpeg (jmm)
-  for 7.1.5
---
 firebird3.0
 --
 firebird4.0



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2b0d62e3723bdfa7dd9d3bbcb67590c1ef3c798a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2b0d62e3723bdfa7dd9d3bbcb67590c1ef3c798a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260622/5e1c855f/attachment-0001.htm>