Bug 30444

Summary:	FFmpeg 4.3.4
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	andrewsfarm, brtians1, davidwhodgins, sysadmin-bugs
Version:	8	Keywords:	advisory, has_procedure, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA8-64-OK
Source RPM:	ffmpeg-4.3.2-1.mga8.src.rpm	CVE:
Status comment:

Description David Walser 2022-05-17 15:51:21 CEST

FFmpeg 4.3.4 has been released on April 15:
https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.3.4

Note that there are core and tainted builds for this package.

Testing procedure:
https://bugs.mageia.org/show_bug.cgi?id=8065#c6
https://bugs.mageia.org/show_bug.cgi?id=14042#c6

Advisory:
========================

Updated ffmpeg packages fix security vulnerabilities:

This update provides ffmpeg version 4.3.4, which fixes several security
vulnerabilities and other bugs which were corrected upstream.

References:
https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.3.4
http://ffmpeg.org/download.html
http://ffmpeg.org/security.html
========================

Updated packages in {core,tainted}/updates_testing:
========================
ffmpeg-4.3.4-1.mga8
libavcodec58-4.3.4-1.mga8
libavfilter7-4.3.4-1.mga8
libavformat58-4.3.4-1.mga8
libavutil56-4.3.4-1.mga8
libffmpeg-devel-4.3.4-1.mga8
libswscaler5-4.3.4-1.mga8
libavresample4-4.3.4-1.mga8
libswresample3-4.3.4-1.mga8
libpostproc55-4.3.4-1.mga8
libffmpeg-static-devel-4.3.4-1.mga8

from ffmpeg-4.3.4-1.mga8.src.rpm

David Walser 2022-05-17 15:51:31 CEST

Keywords: (none) => has_procedure

Comment 1 Brian Rockwell 2022-05-17 22:22:13 CEST

updates_testing version (free)

The following 9 packages are going to be installed:

- ffmpeg-4.3.4-1.mga8.x86_64
- lib64avcodec58-4.3.4-1.mga8.x86_64
- lib64avfilter7-4.3.4-1.mga8.x86_64
- lib64avformat58-4.3.4-1.mga8.x86_64
- lib64avresample4-4.3.4-1.mga8.x86_64
- lib64avutil56-4.3.4-1.mga8.x86_64
- lib64postproc55-4.3.4-1.mga8.x86_64
- lib64swresample3-4.3.4-1.mga8.x86_64
- lib64swscaler5-4.3.4-1.mga8.x86_64


$ ffmpeg -v
ffmpeg version 4.3.4 Copyright (c) 2000-2021 the FFmpeg developers
  built with gcc 10 (Mageia 10.3.0-2.mga8)

converted m4v to avi - it worked

--- will test tainted next

CC: (none) => brtians1

Comment 2 Brian Rockwell 2022-05-17 23:26:39 CEST

tainted

- ffmpeg-4.3.4-1.mga8.tainted.x86_64
- lib64avcodec58-4.3.4-1.mga8.tainted.x86_64
- lib64avfilter7-4.3.4-1.mga8.tainted.x86_64
- lib64avformat58-4.3.4-1.mga8.tainted.x86_64
- lib64avresample4-4.3.4-1.mga8.tainted.x86_64
- lib64avutil56-4.3.4-1.mga8.tainted.x86_64
- lib64postproc55-4.3.4-1.mga8.tainted.x86_64
- lib64swresample3-4.3.4-1.mga8.tainted.x86_64
- lib64swscaler5-4.3.4-1.mga8.tainted.x86_64



converting video using tainted version.

Working as expected.

Comment 3 Brian Rockwell 2022-05-21 04:05:34 CEST

tainted

converted flac to mp3 without issue

Comment 4 Brian Rockwell 2022-05-21 04:08:29 CEST

libx265 testing appears to be working (tainted)

Whiteboard: (none) => MGA8-64-OK

Comment 5 Thomas Andrews 2022-05-21 14:00:50 CEST

Validating. Advisory in Comment 0.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Dave Hodgins 2022-05-22 04:23:38 CEST

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 6 Mageia Robot 2022-05-22 13:27:46 CEST

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0199.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED