PR #14 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/web/pulls/14 Patch URL: https://code.ffmpeg.org/FFmpeg/web/pulls/14.patch
Assisted-by: Fable 5.1 >From abd53e61b8e1da35e83fa1eae08d11fb8ed1d1d3 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 22 Jun 2026 01:10:55 +0200 Subject: [PATCH 1/3] web/security: add 41 CVEs missing from the lists Found by cross-referencing NVD/MITRE. Each fix commit was checked against the CVE's authoritative reference (NVD commit URL, trac ticket, oss-security post or the Chromium patch it originates from) and filed under the release that first contains it. CVE-2021-30123 is marked as a duplicate of the older CVE-2020-24995 for the same fix. CVE-2009-4637 and CVE-2009-4638 are left out: no source ties either to a specific commit. Signed-off-by: Michael Niedermayer <[email protected]> --- src/security | 67 +++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 64 insertions(+), 3 deletions(-) diff --git a/src/security b/src/security index a8b3b97..bf94482 100644 --- a/src/security +++ b/src/security @@ -43,6 +43,7 @@ CVE-2025-63757, 0c6b7f9483a38657c9be824572b4c0c45d4d9fef CVE-2026-8461, c23d4da3128c279b714b282e6ec292e8755007e3, pr/23159 CVE-2026-8461, 5806e8b9f34f1b0663b3017ef9dd1aa5d08116d1, pr/23159 CVE-2026-8461, 374b726ffa878ee1cadb987bd1e1e20cc7ed8845, pr/23159 +CVE-2026-30998, 18b83f2d0a0f9bcbafb0001a2911327c4b8df056, pr/23006 CVE-2026-30999, 144af8f81abc1385631b4e1f4672cd415a9c6e05, pr/23006 </pre> @@ -124,6 +125,7 @@ CVE-2025-10256, a25462482c02c004d685a8fcf2fa63955aaa0931 CVE-2025-12343, 263e819aa45cd3c48bf6887be02b4ec504c02048 / b8d5f65b9e89d893f27cf00799dbc15fc0ca2f8e CVE-2025-22919, 1446e37d3d032e1452844778b3e6ba2c20f0c322, ticket/11385, CVE-2025-22920, 4bf784c0e5615c3f934e677d5de093a8be7da7ae, ticket/11389 never affected a release +CVE-2025-22921, 7f9c7f9849a2155224711f0ff57ecdac6e4bfb57, ticket/11393 CVE-2025-25469, d5873be583ada9e1fb887e2fe8dcfd4b12e0efcd, ticket/11416 CVE-2025-25471, fd1772b7475d0d5673a5dd314ee78443d0be4cf1, ticket/11417 never affected a release CVE-2025-25473, c08d300481b8ebb846cd43a473988fdbc6793d1b, ticket/11419 @@ -175,6 +177,10 @@ Fixes following vulnerabilities: CVE-2024-7055 3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8 CVE-2024-35368, 4513300989502090c4fd6560544dce399a8cd53c (specific to builds with --enable-rkmpp) CVE-2024-36619, 28c7094b25b689185155a6833caf2747b94774a4 +CVE-2024-32228, 459648761f5412acdc3317d5bac982ceaa257584, ticket/10951 +CVE-2024-32229, a528a54ee119dcba47e7c9e30d3a56206fbad416, ticket/10950 +CVE-2024-32230, 96449cfeaeb95fcfd7a2b8d9ccf7719e97471ed1, ticket/10952 +CVE-2024-36615, 0ba058579f332b3060d8470a04ddd3fbf305be61 </pre> @@ -223,6 +229,19 @@ CVE-2024-36613, 50d8e4f27398fd5778485a827d7a2817921f8540 CVE-2024-36616, 86f73277bf014e2ce36dd2594f1e0fb8b3bd6661 CVE-2024-36617, d973fcbcc2f944752ff10e6a76b0b2d9329937a7 CVE-2024-36618, 7a089ed8e049e3bfcb22de1250b86f2106060857 +CVE-2023-49528, 2d9ed64859c9887d0504cd71dbd5b2c15e14251a +CVE-2023-50009, c443658d26d2b8e19901f9507a890e0efca79056 +CVE-2023-50010, e4d2666bdc3dbd177a81bbf428654a5f2fa3787a +CVE-2023-51791, fb54c89a0df3d63198678b17d64aef4dbb599109 +CVE-2023-51793, 0ecc1f0e48930723d7a467761b66850811c23e62 +CVE-2023-51794, 50f0f8c53c818f73fe2d752708e2fa9d2a2d8a07 +CVE-2023-51795, ab0fdaedd1e7224f7e84ea22fcbfaa4ca75a6c06 +CVE-2023-51796, 61e73851a33f0b4cb7662f8578a4695e77bd3c19 +CVE-2023-51797, 08bd2cbfeb34717d60ec62bcbaeb7996206df906 +CVE-2023-51798, 68146f06f852078866b3ef1564556e3a272920c7 +CVE-2024-31581, ce0c178a408d43e71085c28a47d50dc939b60196 +CVE-2024-31585, ab0fdaedd1e7224f7e84ea22fcbfaa4ca75a6c06, duplicate CVE# +CVE-2024-35369, 0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c </pre> @@ -272,6 +291,8 @@ CVE-2023-47344, f7ac3512f5b5cb8eb149f37300b43461d8e93af3 CVE-2024-22860, d2e8974699a9e35cc1a926bf74a972300d629cd5 CVE-2024-22861, 87b8c1081959e45ffdcbabb3d53ac9882ef2b5ce CVE-2024-22862, ca09d8a0dcd82e3128e62463231296aaf63ae6f7 +CVE-2023-46407, bf814387f42e9b0dea9d75c03db4723c88e7d962, never affected a release +CVE-2023-47470, 4565747056a11356210ed8edcecb920105e40b60, never affected a release </pre> @@ -513,10 +534,13 @@ CVE-2020-22038, 7c32e9cf93b712f8463573a59ed4e98fd10fa013, ticket/8285 CVE-2020-22042, 426c16d61a9b5056a157a1a2a057a4e4d13eef84, ticket/8267 CVE-2020-23906, ec59dc73f0cc8930bf5dae389cd76d049d537ca7, ticket/8782 CVE-2020-24020, 584f396132aa19d21bb1e38ad9a5d428869290cb, ticket/8718 -CVE-2021-30123, d6f293353c94c7ce200f6e0975ae3de49787f91f, ticket/8845, never affected a release +CVE-2020-24995, d6f293353c94c7ce200f6e0975ae3de49787f91f, ticket/8845, never affected a release +CVE-2021-30123, d6f293353c94c7ce200f6e0975ae3de49787f91f, ticket/8845, duplicate CVE#, never affected a release CVE-2020-35964, 27a99e2c7d450fef15594671eef4465c8a166bd7 CVE-2020-35965, 3e5959b3457f7f1856d997261e6ac672bba49e8b CVE-2020-35965, b0a8b40294ea212c1938348ff112ef1b9bf16bb3 +CVE-2020-36138, 292e41ce650a7b5ca5de4ae87fff0d6a90d9fc97, ticket/8960, never affected a release +CVE-2021-28429, c94875471e3ba3dc396c6919ff3ec9b14539cd71 </pre> <h2>FFmpeg 4.3</h2> @@ -663,6 +687,9 @@ CVE-2021-38091, 99f8d32129dd233d4eb2efa44678a0bc44869f23, ticket/8263, duplicate CVE-2021-38092, 99f8d32129dd233d4eb2efa44678a0bc44869f23, ticket/8263, duplicate CVE# CVE-2021-38093, 99f8d32129dd233d4eb2efa44678a0bc44869f23, ticket/8263, duplicate CVE# CVE-2021-38094, 99f8d32129dd233d4eb2efa44678a0bc44869f23, ticket/8263, duplicate CVE# +CVE-2020-22049, 373c1c9b691fd4c6831b3a114a006b639304c2af, ticket/8314 +CVE-2020-22051, 673fce6d40d9a594fb7a0ea17d296b7d3d9ea856, ticket/8313 +CVE-2020-22056, daf2bef98ded7f8431fd04bf3324669329a923c1, ticket/8304 </pre> <h2>FFmpeg 4.2</h2> @@ -1216,6 +1243,7 @@ Fixes following vulnerabilities: <pre> CVE-2017-15186, df62b70de8aaa285168e72fe8f6e740843ca91fa CVE-2017-17081, 127a362630e11fe724e2e63fc871791fdcbcfa64 +CVE-2017-15672, c20f4fcb74da2d0432c7b54499bb98f48236b904 </pre> @@ -1337,6 +1365,9 @@ Fixes following vulnerabilities: <pre> CVE-2017-7862, 8c2ea3030af7b40a3c4275696fb5c76cdb80950a CVE-2017-7866, e371f031b942d73e02c090170975561fabd5c264 +CVE-2016-9561, 30581c51e72a7a7ea1572c1c6039f6e4c590a55c +CVE-2017-7863, e477f09d0b3619f3d29173b2cd593e17e2d1978e +CVE-2017-7865, 2080bc33717955a0e4268e738acf8c1eeddbf8cb </pre> @@ -2221,6 +2252,7 @@ Fixes following vulnerabilities: CVE-2014-7933, 490a3ebf36821b81f73e34ad3f554cb523dd2682 CVE-2015-3417, e8714f6f93d1a32f4e4655209960afcf4c185214 CVE-2017-9051, 8d7ce5cdb707d4b22749f72d3f118e62e2b95cd3 +CVE-2015-1208, 3ebd76a9c57558e284e94da367dd23b435e6a6d0 </pre> @@ -2648,6 +2680,7 @@ CVE-2014-125022, 1713eec29add37b654ec6bf262b843d139c1ffc6 CVE-2014-125023, 2240e2078d53d3cfce8ff1dda64e58fa72038602 CVE-2014-125024, 4c3e1956ee35fdcc5ffdb28782050164b4623c0b CVE-2014-125025, 6e42ccb9dbc13836cd52cda594f819d17af9afa2 +CVE-2014-9676, 169065fbfb3da1ab776379c333aebc54bb1f1bc4 </pre> <h2>FFmpeg 2.1</h2> @@ -3642,6 +3675,7 @@ Several security issues that dont have CVE numbers. CVE-2010-3429, 6e73cef6e3b536fbccdb82bd9260440d836b3f03 CVE-2010-4705, 366d919016a679d3955f6fe5278fa7ce4f47b81e CVE-2011-1931, 89f903b3d5ec38c9c5d90fba7e626fa0eda61a32 +CVE-2011-2160, 2bbec1eda46d907605772a8b6e8263caa4bc4c82 </pre> <h2>FFmpeg 0.6</h2> @@ -3652,7 +3686,19 @@ CVE-2011-1931, 89f903b3d5ec38c9c5d90fba7e626fa0eda61a32 <p>Fixes CVE-2011-4352, CVE-2011-4579, CVE-2011-4353, CVE-2011-4351, CVE-2011-4364</p> <h3>0.6.2</h3> -<p>Fixes CVE-2011-2161</p> +<p>Fixes CVE-2011-2160, CVE-2011-2161</p> + +<h3>0.6</h3> +<p> +Fixes following vulnerabilities: +</p> +<pre> +CVE-2009-4631, 310afddfe0c31ffd844eb640bdf2b3f052286dbe +CVE-2009-4632, 98422c44cf86de6da8f73a7bd80284ed165c5a98 +CVE-2009-4633, 08c8742cdb377459f175b963001ae72fdcec4006 +CVE-2009-4635, 4c0dda2b3f45471faa233c62205e712fb072a76b +CVE-2009-4640, aedc98b0a4ee434aa54908b815f78a4c563c1d31 +</pre> <h2>FFmpeg 0.5</h2> <h3>0.5.14</h3> @@ -3701,7 +3747,17 @@ CVE-2013-0868, 272e7f6443b76fb47192930d157bfd9284294188 / f67a0d1152544616494704 <p>Fixes CVE-2011-3504, CVE-2011-3362, CVE-2011-3973, CVE-2011-3974</p> <h3>0.5.4</h3> -<p>Fixes CVE-2010-3908, CVE-2011-0722, CVE-2010-4704, CVE-2011-0480, CVE-2011-0723, CVE-2011-2161</p> +<p>Fixes CVE-2010-3908, CVE-2011-0722, CVE-2010-4704, CVE-2011-0480, CVE-2011-0723, CVE-2011-2160, CVE-2011-2161</p> + +<h3>0.5.1</h3> +<p> +Fixes following vulnerabilities: +</p> +<pre> +CVE-2009-4632, ef84190a1ab777c35ea9fec64c3ab6ce641b79e5 / 98422c44cf86de6da8f73a7bd80284ed165c5a98 +CVE-2009-4633, 9ef13f70f4d38514fa82b998f7e62abb7940f4c1 / 08c8742cdb377459f175b963001ae72fdcec4006 +CVE-2009-4640, 9e3935dfd8c68608534206859b16239a652db37f / aedc98b0a4ee434aa54908b815f78a4c563c1d31 +</pre> <h3>0.5</h3> <p> @@ -3716,4 +3772,9 @@ CVE-2008-4867 4df7beb3686caf2df345d2e10564aa8cf6c24a65 CVE-2008-4868, 847d05360baf01c71c89cf9602fbbf5bd481c232 CVE-2009-0385 0838cfdc8a10185604db5cd9d6bffad71279a0e8 CVE-2016-1528 d99fbbf4d7e3f6abea0d052849a515730f552608 (partial, see c727401aa9d62335e89d118a5b4e202edf39d905) +CVE-2005-4048, c7622f9a28abec959eb6d4859ceb1f102eccc4e8 +CVE-2006-4800, 4f26258f848e2a607f5f26288012492977c2930e +CVE-2006-4800, f267587ecea7a98d398d0fb74e1e04668ddf26e3 +CVE-2006-4800, 3a1a7e32ace7af47de74e8ae779cb4e04c89aa97 +CVE-2006-4800, a443a2530d00b7019269202ac0f5ca8ba0a021c7 </pre> -- 2.52.0 >From 48ac7c7175c420b32a61879034e6c36085949a04 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 19 Sep 2026 06:43:01 +0200 Subject: [PATCH 2/3] web/security: remove CVE-2025-22921 from the 8.1 list bdea5aec fixes UBSan shift errors from an oss-fuzz testcase found a year after the CVE. The NULL dereference of trac ticket 11393 that the CVE describes was fixed by 7f9c7f98, which is listed under 8.0. Signed-off-by: Michael Niedermayer <[email protected]> --- src/security | 1 - 1 file changed, 1 deletion(-) diff --git a/src/security b/src/security index bf94482..df338bd 100644 --- a/src/security +++ b/src/security @@ -67,7 +67,6 @@ Fixes following vulnerabilities: </p> <pre> CVE-2025-12343, b8d5f65b9e89d893f27cf00799dbc15fc0ca2f8e -CVE-2025-22921, bdea5aec2da8ee9dbbc84127d81e056dbbbeda6a, ticket/11393 CVE-2025-67306, faa382e5b196f2acb5bc5b159aaf06682291328b, pr/21108 CVE-2025-67306, 554ae5ada98cd44686ade995102d3aa2295d7b09, pr/21108 CVE-2025-69693, 8abeb879df66ea8d27ce1735925ced5a30813de4 -- 2.52.0 >From cd2d70f08902101d38a2ae482d0cb46b949e614f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 19 Sep 2026 06:43:01 +0200 Subject: [PATCH 3/3] web/security: add the 9.0 release Signed-off-by: Michael Niedermayer <[email protected]> --- src/security | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/src/security b/src/security index df338bd..4792b0c 100644 --- a/src/security +++ b/src/security @@ -47,6 +47,25 @@ CVE-2026-30998, 18b83f2d0a0f9bcbafb0001a2911327c4b8df056, pr/23006 CVE-2026-30999, 144af8f81abc1385631b4e1f4672cd415a9c6e05, pr/23006 </pre> +<h2>FFmpeg 9.0</h2> + +<h3>9.0</h3> +<p> +Fixes following vulnerabilities: +</p> +<pre> +CVE-2026-8461, c23d4da3128c279b714b282e6ec292e8755007e3, pr/23159 +CVE-2026-8461, 5806e8b9f34f1b0663b3017ef9dd1aa5d08116d1, pr/23159 +CVE-2026-8461, 374b726ffa878ee1cadb987bd1e1e20cc7ed8845, pr/23159 +CVE-2026-12706, 2f60af465ad78ae4be85e0bbde4067846d80b582, pr/22992 +CVE-2026-30997, 1a2c16fe514b60e1860829c42ce199de77a007e5, pr/23005 +CVE-2026-30998, 18b83f2d0a0f9bcbafb0001a2911327c4b8df056, pr/23006 +CVE-2026-30999, 144af8f81abc1385631b4e1f4672cd415a9c6e05, pr/23006 +CVE-2026-66038, 7c0b8c8594501dd904ebbb3b45bb3f6e2c745b7d / e7cbfd1c507b57a806a5825b87d609963e862c8c, pr/23626 +CVE-2026-70629, a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4 / cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7, pr/23895 +CVE-2026-70631, 3c287af3affe1286350faa69c02bcc5d49de18bb / 2f234ea34c81288e3840fca632dd16481d8de39f, pr/23899 +</pre> + <h2>FFmpeg 8.1</h2> -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
