[Git][security-tracker-team/security-tracker][master] more ffmpeg issues fixed in sid

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
61b9220d by Moritz Muehlenhoff at 2026-09-20T15:33:28+02:00
more ffmpeg issues fixed in sid

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -71839,40 +71839,46 @@ CVE-2026-65012 (InvokeAI before 6.13.7 contains an unauthenticated directory enu
 CVE-2026-65011 (Graylog2 Server before commit 46a2eeb contains a missing per-entity pe ...)
 	- graylog2 <itp> (bug #652273)
 CVE-2026-64835 (FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory acce ...)
-	- ffmpeg <unfixed>
+	- ffmpeg 7:9.0.2-1
 	[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
 	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659
-	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e (n9.0)
 CVE-2026-64834 (FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerabi ...)
-	- ffmpeg <unfixed>
+	- ffmpeg 7:9.0.2-1
 	[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
 	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663
-	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632 (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c441711a343ccf50196c70a3f0b554b52f8d9de (n9.0)
 CVE-2026-64833 (FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vuln ...)
-	- ffmpeg <unfixed>
+	- ffmpeg 7:9.0.2-1
 	[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
 	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661
-	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4 (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/385ac2fadcb4394ec4f65e5c4d3d24003e090f36 (n9.0)
 CVE-2026-64832 (FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability  ...)
-	- ffmpeg <unfixed>
+	- ffmpeg 7:9.0.2-1
 	[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
 	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664
 	NOTE: Introduced with: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/72982f8cb5dad6252a14226d28128313eed4a5ff (n4.4)
-	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97 (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3d5ad47c40436dbdeaaa6601af0bb4575d5aa3c5 (n9.0)
 	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9cbcf979a587a66b280496657d00fabe301bf20f (release/8.1)
 CVE-2026-64831 (FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vul ...)
-	- ffmpeg <unfixed>
+	- ffmpeg 7:9.0.2-1
 	[trixie] - ffmpeg <not-affected> (Vulnerable code not present)
 	[bookworm] - ffmpeg <not-affected> (Vulnerable code not present)
 	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665
 	NOTE: Introduced with: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/82864c21112157951ce91b4430a9018edd02f5ab (n8.0)
-	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3d129a4a8531e9f7baa8558c7c994b4dd36bcf04 (n9.0)
 	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6b3015cd92d4a0f96b0511e8110c50ac0dcc9d3a (release/8.1)
 CVE-2026-64830 (FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vuln ...)
-	- ffmpeg <unfixed>
+	- ffmpeg 7:9.0.2-1
 	[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
 	NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657
-	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951 (master)
+	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dcf8ce2802bf2be1b0c6b8d4996abca7b669978d (n9.0)
 CVE-2026-64828 (Froiden TableTrack through 1.3.10 contains a stored cross-site scripti ...)
 	NOT-FOR-US: Froiden TableTrack
 CVE-2026-63264 (Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < ...)
@@ -93987,7 +93993,7 @@ CVE-2026-58050 (libssh2 through 1.11.1 reads an attacker-controlled 32-bit attri
 	NOTE: https://github.com/libssh2/libssh2/pull/2128
 	NOTE: Fixed by: https://github.com/libssh2/libssh2/commit/34497525929b9a47f03dfb81887ac896202b7e12
 CVE-2026-58049 (FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) perform ...)
-	- ffmpeg <unfixed>
+	- ffmpeg 7:9.0.2-1
 	[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
 	NOTE: https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc
 	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11ff18a6c80187405fc492f9bb07ba9f2f663f76



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/61b9220dcd97d196e2414465563e817ffdd13759

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/61b9220dcd97d196e2414465563e817ffdd13759
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260920/7484fa5a/attachment.htm>