diff options
author | Narpat Mali <narpat.mali@windriver.com> | 2023-08-18 14:59:59 +0000 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2023-08-21 11:34:12 +0100 |
commit | 081f4ecaed813d5027cfb5100017abe8cf200e67 (patch) | |
tree | 1334369c6ce90c028d26d6d885be7c907f15268f /meta/recipes-multimedia/ffmpeg | |
parent | f32ff564f36d2fcf1a9381c520d46d0266fb00b1 (diff) | |
download | poky-081f4ecaed813d5027cfb5100017abe8cf200e67.tar.gz |
ffmpeg: add CVE_STATUS for CVE-2023-39018
CVE-2023-39018 belongs to ffmpeg-cli-wrapper (Java wrapper around the FFmpeg CLI)
and not ffmpeg itself. As per CVE description, it is mentioned as FFmpeg 0.7.0 which
is the version for ffmpeg-cli-wrapper and ffmpeg don't have 0.7.0 version at all.
Debian & Bugzilla trackers have already marked as NOT-FOR-US/RESOLVED-INVALID.
As it won't be affecting the ffmpeg package so, we can ignore the CVE-2023-39018
in ffmpeg recipe.
References:
https://github.com/bramp/ffmpeg-cli-wrapper
https://github.com/FFmpeg/FFmpeg
https://security-tracker.debian.org/tracker/CVE-2023-39018
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-39018
(From OE-Core rev: c21ed498b423c13463a4ae0bb475883cc7901847)
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-multimedia/ffmpeg')
-rw-r--r-- | meta/recipes-multimedia/ffmpeg/ffmpeg_6.0.bb | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.0.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.0.bb index 07c641dc96..eb8dcad8a2 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.0.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.0.bb | |||
@@ -28,6 +28,13 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ | |||
28 | 28 | ||
29 | SRC_URI[sha256sum] = "57be87c22d9b49c112b6d24bc67d42508660e6b718b3db89c44e47e289137082" | 29 | SRC_URI[sha256sum] = "57be87c22d9b49c112b6d24bc67d42508660e6b718b3db89c44e47e289137082" |
30 | 30 | ||
31 | # https://nvd.nist.gov/vuln/detail/CVE-2023-39018 | ||
32 | # https://github.com/bramp/ffmpeg-cli-wrapper/issues/291 | ||
33 | # https://security-tracker.debian.org/tracker/CVE-2023-39018 | ||
34 | # https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-39018 | ||
35 | CVE_STATUS[CVE-2023-39018] = "cpe-incorrect: This issue belongs to ffmpeg-cli-wrapper \ | ||
36 | (Java wrapper around the FFmpeg CLI) and not ffmepg itself." | ||
37 | |||
31 | # Build fails when thumb is enabled: https://bugzilla.yoctoproject.org/show_bug.cgi?id=7717 | 38 | # Build fails when thumb is enabled: https://bugzilla.yoctoproject.org/show_bug.cgi?id=7717 |
32 | ARM_INSTRUCTION_SET:armv4 = "arm" | 39 | ARM_INSTRUCTION_SET:armv4 = "arm" |
33 | ARM_INSTRUCTION_SET:armv5 = "arm" | 40 | ARM_INSTRUCTION_SET:armv5 = "arm" |