[Git][security-tracker-team/security-tracker][master] ffmpeg updates

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
99b0ebd7 by Moritz Muehlenhoff at 2026-09-08T18:57:04+02:00
ffmpeg updates

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -50783,15 +50783,17 @@ CVE-2026-64833 (FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds rea
 	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661
 	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4
 CVE-2026-64832 (FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability  ...)
-	- ffmpeg <unfixed>
+	- ffmpeg 7:8.1-1
 	[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
 	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664
 	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9cbcf979a587a66b280496657d00fabe301bf20f (release/8.1)
 CVE-2026-64831 (FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vul ...)
-	- ffmpeg <unfixed>
+	- ffmpeg 7:8.1-1
 	[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
 	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665
 	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6b3015cd92d4a0f96b0511e8110c50ac0dcc9d3a (release/8.1)
 CVE-2026-64830 (FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vuln ...)
 	- ffmpeg <unfixed>
 	[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
@@ -72859,6 +72861,8 @@ CVE-2026-58049 (FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) p
 	- ffmpeg <unfixed>
 	[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
 	NOTE: https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11ff18a6c80187405fc492f9bb07ba9f2f663f76
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f8d7795dcca36a4dd412e89cbd83e3dfec1e0d81 (n9.0)
 CVE-2026-13483 (A flaw has been found in arc53 DocsGPT up to 0.18.0. The affected elem ...)
 	NOT-FOR-US: arc53 DocsGPT
 CVE-2026-13482 (A vulnerability was detected in skypilot-org skypilot up to 0.12.0. Im ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/99b0ebd7e20280193e2fc267a2318e8da27b2ea1

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/99b0ebd7e20280193e2fc267a2318e8da27b2ea1
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260908/67b9dba6/attachment.htm>