Bug 9616 - ffmpeg new security issues fixed in 1.1.4
Summary: ffmpeg new security issues fixed in 1.1.4
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: i586 Linux
Priority: Normal major
Target Milestone: ---
Assignee: Mageia Bug Squad
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/545986/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-04-04 18:54 CEST by David Walser
Modified: 2013-04-05 14:52 CEST (History)
1 user (show)

See Also:
Source RPM: ffmpeg-1.1.2-1.mga3.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2013-04-04 18:54:31 CEST 
Ubuntu has issued an advisory today (April 4):
http://www.ubuntu.com/usn/usn-1790-1/

This addresses 4 CVEs:
CVE-2013-0894, CVE-2013-2277, CVE-2013-2495, CVE-2013-2496

I don't know if these affect Mageia 2, but I don't see commits for them in git in the 0.10 branch, even though I do see recent commits, so I'm going to guess no for now.  See Bug 8881 for ffmpeg security issues affecting Mageia 2.

I do see CVE-2013-0894 and CVE-2013-2277 fixed in the 1.1 branch git log.  I believe the CVE-2013-249[56] are fixed in the iff and msrle changes from 3 weeks ago, even though those CVEs aren't referenced specifically in the commit messages.

Reproducible: 

Steps to Reproduce:
David Walser 2013-04-04 18:54:44 CEST

CC: (none) => fundawang

Comment 1 David Walser 2013-04-05 14:52:15 CEST 
Fixed in fmpeg-1.1.4-1.mga3.  Thanks Funda!

Status: NEW => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.