Funda built an update for ffmpeg in updates_testing yesterday. Note that there are core and tainted packages to test. Procedure: https://bugs.mageia.org/show_bug.cgi?id=8065#c6 Advisory: -------------------------------------------------- This updates provides ffmpeg version 2.0.4, which fixes several bugs which were corrected upstream. References: http://git.videolan.org/?p=ffmpeg.git;a=log;h=n2.0.4 http://ffmpeg.org/olddownload.html -------------------------------------------------- Updated packages in {core,tainted}/updates_testing: -------------------------------------------------- ffmpeg-2.0.4-1.mga4 libavcodec55-2.0.4-1.mga4 libpostproc52-2.0.4-1.mga4 libavformat55-2.0.4-1.mga4 libavutil52-2.0.4-1.mga4 libswscaler2-2.0.4-1.mga4 libavfilter3-2.0.4-1.mga4 libswresample0-2.0.4-1.mga4 libffmpeg-devel-2.0.4-1.mga4 libffmpeg-static-devel-2.0.4-1.mga4 from ffmpeg-2.0.4-1.mga4.src.rpm Reproducible: Steps to Reproduce:
Whiteboard: (none) => has_procedure
CC: sysadmin-bugs => (none)Component: Release (media or process) => RPM Packages
I just noticed that http://ffmpeg.org/security.html lists some CVEs that are relevant for this update. I may or may not have more details later. Fixed in 2.0.4 - CVE-2014-209[789], CVE-2014-2263 Advisory: ======================== Updated ffmpeg packages fix security vulnerabilities: This updates provides ffmpeg version 2.0.4, which fixes several unspecified security vulnerabilities and other bugs which were corrected upstream. References: http://git.videolan.org/?p=ffmpeg.git;a=log;h=n2.0.4 http://ffmpeg.org/olddownload.html http://ffmpeg.org/security.html
Component: RPM Packages => SecurityQA Contact: (none) => security
I asked in #ffmpeg-devel about any other issues that may have been fixed in 1.1.10 and 1.1.11. <michaelni> Luigi12_work, i suggest you wait a day or 2 before updating from packages from branch theres some backports pending <michaelni> packages from 1.1 branch <Luigi12_work> michaelni: are these backports pending for 2.0.x as well? <michaelni> yes, ill try to get them out ASAP So let's hold this one until next week.
Whiteboard: has_procedure => has_procedure feedback
2.0.5 has been tagged in git, so we should be able to update it soon. It hasn't been announced yet, and I'm still waiting on their security page to be updated.
The ffmpeg webpages have been updated. Version 2.0.5 is out, which also fixes CVE-2014-4609 and CVE-2014-4610.
(In reply to David Walser from comment #4) > The ffmpeg webpages have been updated. Version 2.0.5 is out, which also > fixes CVE-2014-4609 and CVE-2014-4610. Information on those CVEs: http://openwall.com/lists/oss-security/2014/06/26/22 http://openwall.com/lists/oss-security/2014/06/26/23
(In reply to David Walser from comment #5) > (In reply to David Walser from comment #4) > > The ffmpeg webpages have been updated. Version 2.0.5 is out, which also > > fixes CVE-2014-4609 and CVE-2014-4610. > > Information on those CVEs: > http://openwall.com/lists/oss-security/2014/06/26/22 > http://openwall.com/lists/oss-security/2014/06/26/23 It looks like CVE-2014-4610 is actually the appropriate CVE to use (being for ffmpeg, CVE-2014-4609 being the same for the libav fork). The issue is an integer overflow in LZO decompression.
Updated packages uploaded for Mageia 4. Note to QA: there are core and tainted builds for this package. Advisory: ======================== Updated ffmpeg packages fix security vulnerabilities: The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.0.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data (CVE-2014-2097). libavcodec/wmalosslessdec.c in FFmpeg before 2.0.4 uses an incorrect data-structure size for certain coefficients, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted WMA data (CVE-2014-2098). The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 2.0.4 does not properly calculate line sizes, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Microsoft RLE video data (CVE-2014-2099). The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg before 2.0.4 allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write (CVE-2014-2263). An integer overflow in LZO decompression in FFmpeg before 2.0.5 allows remote attackers to have an unspecified impact by embedding compressed data in a video file (CVE-2014-4610). This updates provides ffmpeg version 2.0.5, which fixes these issues and several other bugs which were corrected upstream. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2097 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2098 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2099 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2263 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4610 http://git.videolan.org/?p=ffmpeg.git;a=log;h=n2.0.5 http://ffmpeg.org/olddownload.html http://ffmpeg.org/security.html http://openwall.com/lists/oss-security/2014/06/26/23 ======================== Updated packages in {core,tainted}/updates_testing: ======================== ffmpeg-2.0.5-1.mga4 libavcodec55-2.0.5-1.mga4 libpostproc52-2.0.5-1.mga4 libavformat55-2.0.5-1.mga4 libavutil52-2.0.5-1.mga4 libswscaler2-2.0.5-1.mga4 libavfilter3-2.0.5-1.mga4 libswresample0-2.0.5-1.mga4 libffmpeg-devel-2.0.5-1.mga4 libffmpeg-static-devel-2.0.5-1.mga4 from ffmpeg-2.0.5-1.mga4.src.rpm
Summary: ffmpeg update to 2.0.4 => ffmpeg update to 2.0.5Whiteboard: has_procedure feedback => has_procedureSeverity: normal => major
David Geiger posted successful test results for this update in Bug 13595.
Whiteboard: has_procedure => has_procedure MGA4-64-OK MGA4-32-OK
Tested mga4_64 & mga4_32, (1) Testing complete for the new ffmpeg-2.0.5-1.mga4, all seems works fine for me. I used it to convert an : ->.wmv video file to a .avi video file =Ok ->.wmv video file to a .mkv video file =Ok ->.wmv video file to a .flv video file =Ok ->.wmv video file to a .mpg video file =Ok ->.wmv video file to a .mov video file =Not Ok (Need the Tainted) ->.mkv video file to a .avi video file =Ok ->.mkv video file to a .flv video file =Ok ->.mkv video file to a .wmv video file =Ok ->.mkv video file to a .mpg video file =Ok ->.mkv video file to a .mov video file =Not Ok (Need the Tainted) (2) Testing complete for the new ffmpeg-2.0.5-1.mga4.tainted, all seems works fine for me too. I used it to convert an : ->.wmv video file to a .avi video file =Ok ->.wmv video file to a .mkv video file =Ok ->.wmv video file to a .flv video file =Ok ->.wmv video file to a .mpg video file =Ok ->.wmv video file to a .mov video file =Ok ->.mkv video file to a .avi video file =Ok ->.mkv video file to a .flv video file =Ok ->.mkv video file to a .wmv video file =Ok ->.wmv video file to a .mpg video file =Ok ->.mkv video file to a .mov video file =Ok
CC: (none) => geiger.david68210
Update validated and advisory uploaded. Please push ffmpeg to Mageia 4 {core,tainted}/updates.
Keywords: (none) => validated_updateWhiteboard: has_procedure MGA4-64-OK MGA4-32-OK => has_procedure MGA4-64-OK MGA4-32-OK advisoryCC: (none) => remi, sysadmin-bugs
Update pushed: http://advisories.mageia.org/MGASA-2014-0280.html
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED
URL: (none) => http://lwn.net/Vulnerabilities/604603/