linux/poky.git/meta/recipes-multimedia/ffmpeg, branch yocto-5.0.8

ffmpeg: Correct the CVE ID to fix CVE-2025-22919

2025-03-08T14:22:57+00:00

A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file. (From OE-Core rev: bf0ad79c46d8a01aafc91620ddf415749aa8849a) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

ffmpeg: fix CVE-2025-0518

2025-03-08T14:22:57+00:00

Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C This issue affects FFmpeg: 7.1. Issue was fixed: https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosma (From OE-Core rev: 75ad6e004de95ff6208820ccf2c0af01d9363749) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

ffmpeg: fix CVE-2025-22921

2025-03-08T14:22:57+00:00

FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c. (From OE-Core rev: bc9cdf3701b937d40964903a3489898a69525d17) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

ffmpeg: fix CVE-2025-25471

2025-03-08T14:22:57+00:00

FFmpeg git master before commit fd1772 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c. (From OE-Core rev: a8331b11d5d7aa8f1997eaa189b74aaab7cc44da) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

ffmpeg: fix CVE-2025-25473

2025-03-08T14:22:56+00:00

FFmpeg git master before commit c08d30 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c. (From OE-Core rev: abc6b3180b87c665ff04204b7163d1f074d99747) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

ffmpeg: fix CVE-2024-35369

2025-02-14T14:38:54+00:00

In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process. (From OE-Core rev: c46bb37a76582ee7352f2bc027920e8ba76e5c15) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

ffmpeg: fix CVE-2024-36619

2025-02-14T14:38:54+00:00

FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition. (From OE-Core rev: 161711ba2ef14fa77fba4740b1933c68043c57c7) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

ffmpeg: fix CVE-2024-36618

2025-02-14T14:38:54+00:00

FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition. (From OE-Core rev: 21230d5dfe908533958712e06316a253e16b9d2e) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

ffmpeg: fix CVE-2024-36617

2025-02-14T14:38:53+00:00

FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder. (From OE-Core rev: 8057ba630477a7aeedf057b7e1ce25ab0c445665) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

ffmpeg: fix CVE-2024-36616

2025-02-14T14:38:53+00:00

An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file. (From OE-Core rev: fe7df1727d8ea4868091236ddfff7ea862c1ada8) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman