mbox series

[bug#72799,0/3] ffmpeg updates [fixes CVE-2024-7055, CVE-2024-7272]

Message ID cover.1724546078.git.ashish.is@lostca.se
Headers
Series ffmpeg updates [fixes CVE-2024-7055, CVE-2024-7272] |

Message

yelninei--- via Guix-patches via Aug. 25, 2024, 12:34 a.m. UTC 
From: Ashish SHUKLA <ashish.is@lostca.se>

Hi,

Attached series of patches updates ffmpeg to latest versions which fixes
following vulnerabilities:

CVE-2024-7055
CVE-2024-7272

Thanks!

Ashish SHUKLA (3):
  gnu: ffmpeg: Update to 6.1.2 [fixes CVE-2024-7055].
  gnu: ffmpeg-5: Update to 5.1.6 [fixes CVE-2024-7055, CVE-2024-7272].
  gnu: ffmpeg-4: Update to 4.4.5 [fixes CVE-2024-7055].

 gnu/packages/video.scm | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)


base-commit: f25ea6847fa4eb1bc0a6bfb965e145b94f20a6f8

Comments

Rodion Goritskov Aug. 30, 2024, 9:30 p.m. UTC | #1 
Hi!

Patches apply and build fine.

However, it looks like ffmpeg-4 and ffmpeg-6 triggers lots (~1000 for
ffmpeg-4 and ~700 for ffmpeg-6) package rebuilds.
ffmpeg-5 is fine, only 12 packages to be rebuild.

Maybe ffmpeg-4 and ffmpeg-6 should be grafted (these CVEs looks scary) and patches for them send
in the separate branch?

Need some experienced maintainers to understand how it should be resolved.
Maxim Cournoyer Nov. 12, 2024, 12:09 p.m. UTC | #2 
Hello,

Rodion Goritskov <rodion.goritskov@gmail.com> writes:

> Hi!
>
> Patches apply and build fine.
>
> However, it looks like ffmpeg-4 and ffmpeg-6 triggers lots (~1000 for
> ffmpeg-4 and ~700 for ffmpeg-6) package rebuilds.
> ffmpeg-5 is fine, only 12 packages to be rebuild.
>
> Maybe ffmpeg-4 and ffmpeg-6 should be grafted (these CVEs looks scary) and patches for them send
> in the separate branch?
>
> Need some experienced maintainers to understand how it should be resolved.

It would have been better to build on a topic branch, but I've opted to
take a shortcut here and push directly to master for this time.

Closing!