[Git][security-tracker-team/security-tracker][master] More ffmpeg issues fixed in sid

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
250435a6 by Moritz Muehlenhoff at 2026-09-20T13:25:01+02:00
More ffmpeg issues fixed in sid

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -69999,38 +69999,44 @@ CVE-2026-66337 (A flaw was found in libsoup. An unsigned integer underflow in th
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2506949
 	NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/532
 CVE-2026-66041 (FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out ...)
-	- ffmpeg <unfixed>
+	- ffmpeg 7:9.0.2-1
 	[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
 	[bookworm] - ffmpeg <not-affected> (Vulnerable code not present)
 	[bullseye] - ffmpeg <not-affected> (Vulnerable code not present)
 	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625
-	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5
+	NOTE: Fixed by https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5 (master)
+	NOTE: Fixed by https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c20d78c6838ae62e9954163833d24fc0ed1b74a3 (n9.0)
 	NOTE: Introduced with: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/030e1401451200566a5303f35cbe1456e31dd81e (n7.0)
 CVE-2026-66040 (FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of- ...)
-	- ffmpeg <unfixed>
+	- ffmpeg 7:9.0.2-1
 	[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
 	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786
-	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5185caaeb8e2c05f7369cbedf0f616601bd82d5c (n9.0)
 CVE-2026-66039 (FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integ ...)
-	- ffmpeg <unfixed>
+	- ffmpeg 7:9.0.2-1
 	[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
 	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631
-	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718 (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/947c57d9e68800dd4d39f110140f8f6c34cedf80 (n9.0)
 CVE-2026-66038 (FFmpeg through 8.1.2, fixed in commit 8670835, contains an information ...)
-	- ffmpeg <unfixed>
+	- ffmpeg 7:9.0.2-1
 	[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
 	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626
-	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/7c0b8c8594501dd904ebbb3b45bb3f6e2c745b7d (n9.0)
 CVE-2026-66037 (FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolle ...)
-	- ffmpeg <unfixed>
+	- ffmpeg 7:9.0.2-1
 	[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
 	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627
-	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5 (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f15e730cd225763bbae68614af777560aeb449dd (n9.0)
 CVE-2026-66036 (FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of- ...)
-	- ffmpeg <unfixed>
+	- ffmpeg 7:9.0.2-1
 	[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
 	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783
-	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/62294b6a8ad2370e1435bb9985ebe6b53be14c2b (n9.0)
 CVE-2026-62835 (Improper authorization in Azure Portal allows an unauthorized attacker ...)
 	NOT-FOR-US: Microsoft
 CVE-2026-61892 (Weintek cMT3092X HMI allows a non-privileged user to modify tokens to  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/250435a6e193ae98f39646f9fb3e1a1c67c4fa24

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/250435a6e193ae98f39646f9fb3e1a1c67c4fa24
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260920/bd90bcc4/attachment.htm>