| Summary: | ffmpeg update to 1.1.8 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | Oden Eriksson <oe> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | luigiwalser, rverschelde, stormi-mageia, sysadmin-bugs, tmb |
| Version: | 3 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/586334/ | ||
| Whiteboard: | has_procedure advisory mga3-32-ok MGA3-64-OK | ||
| Source RPM: | ffmpeg | CVE: | |
| Status comment: | |||
|
Description
Oden Eriksson
2013-11-24 11:18:01 CET
Oden Eriksson
2013-11-24 11:18:27 CET
Source RPM:
(none) =>
ffmpeg Adding all these CVEs in this bug and worry about dupes or if it's been fixed later. It doesn't appear that any of those CVEs are relevant for us, as we already have versions 1.1.5 in Mageia 3 and 2.0.2 in Cauldron. That being said, I've meant to update ffmpeg just because, and forgot to do so before Mageia 2 closed. You might want to update to 0.10.10 that I just checked into Mageia 2 SVN for MBS. For Mageia 3, we should update to 1.1.7 that I just checked into SVN. It has apparently become impossible to find information on security fixes in ffmpeg, so it'd probably just be a MGAA announced as a bugfix update, unless you have more information. http://ffmpeg.org/security.html does not say much. (In reply to Oden Eriksson from comment #3) > http://ffmpeg.org/security.html does not say much. No and it's never up to date, but at least their git commit messages used to identify the CVEs being fixed. They don't do that anymore. In the #ffmpeg-devel channel: <oden> hello. trying to understand what security fixes has been fixed in 0.10 since 0.10.6 to 0.10.10. http://ffmpeg.org/security.html does not say. <michaelni> oden, ill try to update the page, but 0.10 is quite old (In reply to Oden Eriksson from comment #5) > In the #ffmpeg-devel channel: > > <oden> hello. trying to understand what security fixes has been fixed in > 0.10 since 0.10.6 to 0.10.10. http://ffmpeg.org/security.html does not say. > <michaelni> oden, ill try to update the page, but 0.10 is quite old <michaelni> oden, security page updated, ill add CVE# where they are missing as soon as they are assigned http://www.openwall.com/lists/oss-security/2013/11/26/7 <- for FFmpeg 2.1 (In reply to Oden Eriksson from comment #6) > (In reply to Oden Eriksson from comment #5) > > In the #ffmpeg-devel channel: > > > > <oden> hello. trying to understand what security fixes has been fixed in > > 0.10 since 0.10.6 to 0.10.10. http://ffmpeg.org/security.html does not say. > > <michaelni> oden, ill try to update the page, but 0.10 is quite old > > <michaelni> oden, security page updated, ill add CVE# where they are missing > as soon as they are assigned <michaelni> oden, there where some things backported that may or may not be security relevant, for example a infinite loop fix, also there was some fixes merged from libav that i belive where redundant and fixed previously. also i dont think any ffmpeg version or fork from the 0.10 times is completely free of security issues I've ffmpeg to versions 1.1.8 for Mageia 3 and 2.0.3 for Mageia 4. I don't know what all security vulnerabilities were fixed since 1.1.5, as they don't usually tag commits with CVEs anymore. Version 1.1.8 has commits that indicate CVE-2012-6617 and CVE-2013-0845, so we at least have those two, but I don't want to include an incomplete list in the advisory. If anyone can obtain more information about this, we could enhance the advisory. This bug will be for the Mageia 3 update, and we'll use Bug 12698 for the Mageia 4 update. Advisory: ======================== Updated ffmpeg packages fix security vulnerabilities: This updates provides ffmpeg version 1.1.8, which fixes several unspecified security vulnerabilities and other bugs which were corrected upstream. References: http://git.videolan.org/?p=ffmpeg.git;a=log;h=n1.1.8 http://ffmpeg.org/olddownload.html ======================== Updated packages in {core,tainted}/updates_testing: ======================== ffmpeg-1.1.8-1.mga3 libavcodec54-1.1.8-1.mga3 libpostproc52-1.1.8-1.mga3 libavformat54-1.1.8-1.mga3 libavutil52-1.1.8-1.mga3 libswscaler2-1.1.8-1.mga3 libavfilter3-1.1.8-1.mga3 libswresample0-1.1.8-1.mga3 libffmpeg-devel-1.1.8-1.mga3 libffmpeg-static-devel-1.1.8-1.mga3 from ffmpeg-1.1.8-1.mga3.src.rpm Assignee:
bugsquad =>
qa-bugs
David Walser
2014-02-10 00:14:37 CET
Summary:
Multiple vulnerabilities in ffmpeg =>
ffmpeg update to 1.1.8 Basic testing procedure at https://bugs.mageia.org/show_bug.cgi?id=8065#c6 Don't forget to test packages from both core and tainted. CC:
(none) =>
stormi Testing complete Mageia 3 x86_64. CC:
(none) =>
remi Testing mga3 32 Testing complete mga3 32 Whiteboard:
has_procedure MGA3-64-OK =>
has_procedure mga3-32-ok MGA3-64-OK Advisory uploaded. Validating. Could sysadmin please push to 3 updates Thanks Keywords:
(none) =>
validated_update Update pushed: http://advisories.mageia.org/MGASA-2014-0066.html Status:
NEW =>
RESOLVED
David Walser
2014-02-14 18:50:40 CET
URL:
(none) =>
http://lwn.net/Vulnerabilities/586334/ |