[Git][security-tracker-team/security-tracker][master] Add CVE-2026-107698/ffmpeg

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
2873be6c by Salvatore Bonaccorso at 2026-10-09T11:39:13+02:00
Add CVE-2026-107698/ffmpeg

- - - - -


2 changed files:

- data/CVE/list
- data/DSA/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -509,7 +509,11 @@ CVE-2026-107700 (dot-access 0.0.3 through 1.0.0 contains a code injection vulner
 CVE-2026-107699 (ppt2png through 0.0.6 contains an OS command injection vulnerability t ...)
 	NOT-FOR-US: ppt2png Node.js module
 CVE-2026-107698 (FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side requ ...)
-	TODO: check
+	- ffmpeg <unfixed>
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ea9e85e54981b8402368d0f21648836d6738f1b1 (n8.1)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f9aa8729bce10e99046e69754d61e43c00f7877b (n8.0.2)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/7c011995e394e04f685d6674727dd490cfb297ba (n7.1.4)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b05562b9b399057b6537fae337d0eeabcff6ef5c (n5.1.9)
 CVE-2026-107697 (FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS ...)
 	TODO: check
 CVE-2026-107696 (FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rts ...)


=====================================
data/DSA/list
=====================================
@@ -555,7 +555,7 @@
 	{CVE-2026-52718 CVE-2026-52719 CVE-2026-53701}
 	[trixie] - gst-plugins-bad1.0 1.26.2-3+deb13u2
 [22 Jun 2026] DSA-6361-1 ffmpeg - security update
-	{CVE-2025-22921 CVE-2026-8461 CVE-2026-30997 CVE-2026-38347 CVE-2026-52296 CVE-2026-52297 CVE-2026-13858 CVE-2026-96611}
+	{CVE-2025-22921 CVE-2026-8461 CVE-2026-30997 CVE-2026-38347 CVE-2026-52296 CVE-2026-52297 CVE-2026-13858 CVE-2026-96611 CVE-2026-107698}
 	[trixie] - ffmpeg 7:7.1.5-0+deb13u1
 [21 Jun 2026] DSA-6360-1 squid - security update
 	{CVE-2026-33515 CVE-2026-33526 CVE-2026-47729 CVE-2026-50012}
@@ -851,7 +851,7 @@
 	[bookworm] - openjpeg2 2.5.0-2+deb12u3
 	[trixie] - openjpeg2 2.5.3-2.1~deb13u2
 [15 May 2026] DSA-6276-1 ffmpeg - security update
-	{CVE-2026-40962 CVE-2026-30997 CVE-2026-38343 CVE-2026-38344 CVE-2026-38346 CVE-2026-38348 CVE-2026-38349 CVE-2026-90815}
+	{CVE-2026-40962 CVE-2026-30997 CVE-2026-38343 CVE-2026-38344 CVE-2026-38346 CVE-2026-38348 CVE-2026-38349 CVE-2026-90815 CVE-2026-107698}
 	[bookworm] - ffmpeg 7:5.1.9-0+deb12u1
 [15 May 2026] DSA-6275-1 linux - security update
 	{CVE-2026-46333}



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2873be6c25900b08efa22505d558041774cbfdcb

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2873be6c25900b08efa22505d558041774cbfdcb
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261009/8c4a3f9d/attachment.htm>