Bug 31796 - ffmpeg new security issues CVE-2022-2566 and CVE-2022-48434
Summary: ffmpeg new security issues CVE-2022-2566 and CVE-2022-48434
Status: RESOLVED OLD
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Stig-Ørjan Smelror
QA Contact: Sec team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-04-13 18:19 CEST by David Walser
Modified: 2024-03-13 15:38 CET (History)
1 user (show)

See Also:
Source RPM: ffmpeg-4.3.5-1.2.mga8.src.rpm
CVE:
Status comment: Fixed upstream in 6.0

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2023-04-13 18:19:34 CEST 
Fedora has issued an advisory today (April 13):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/PQHNSWXFUN3VJ3AO2AEJUK3BURSGM5G2/

It claims that CVE-2022-48434 is fixed upstream in 5.1.3, but upstream's page only shows that being fixed in 6.0, so we should double check that for Cauldron.  Upstream's page also shows CVE-2022-2566 fixed in 6.0, which we haven't addressed yet.
http://ffmpeg.org/security.html

There are other issues fixed in 6.0 in Bug 31677.
David Walser 2023-04-13 18:19:53 CEST

See Also: (none) => https://bugs.mageia.org/show_bug.cgi?id=31677

Comment 1 Lewis Smith 2023-04-13 21:49:09 CEST 
Another ffmpeg CVE fix for Stig.

Assignee: bugsquad => smelror
Status comment: (none) => ? fixed in 6.0

David Walser 2023-04-14 01:12:29 CEST

Status comment: ? fixed in 6.0 => Fixed upstream in 6.0

Comment 2 David Walser 2023-05-06 23:39:01 CEST 
SUSE has issued an advisory for CVE-2022-48434 on May 2:
https://lists.suse.com/pipermail/sle-security-updates/2023-May/014717.html

They back ported a fix to FFmpeg 4.4.x.
Comment 3 Nicolas Salguero 2024-03-13 15:38:32 CET 
Mageia 8 EOL.

Status: NEW => RESOLVED
Resolution: (none) => OLD
CC: (none) => nicolas.salguero
Note You need to log in before you can comment on or make changes to this bug.