This update for ffmpeg to version 3.3 fixes several issues.
These security issues were fixed:
- CVE-2016-10190: Heap-based buffer overflow in libavformat/http.c in FFmpeg allowed remote web servers to execute arbitrary code via a negative chunk size in an HTTP response (boo#1022920)
- CVE-2016-10191: Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg allowed remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches (boo#1022921)
- CVE-2016-10192: Heap-based buffer overflow in ffserver.c in FFmpeg allowed remote attackers to execute arbitrary code by leveraging failure to check chunk size (boo#1022922)
- CVE-2017-7859: FFmpeg had an out-of-bounds write caused by a heap-based buffer overflow related to the ff_h264_slice_context_init function in libavcodec/h264dec.c (bsc#1034183).
- CVE-2017-7862: FFmpeg had an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame function in libavcodec/pictordec.c (bsc#1034181).
- CVE-2017-7863: FFmpeg had an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame_common function in libavcodec/pngdec.c (boo#1034179)
- CVE-2017-7865: FFmpeg had an out-of-bounds write caused by a heap-based buffer overflow related to the ipvideo_decode_block_opcode_0xA function in libavcodec/interplayvideo.c and the avcodec_align_dimensions2 function in libavcodec/utils.c (boo#1034177)
- CVE-2017-7866: FFmpeg had an out-of-bounds write caused by a stack-based buffer overflow related to the decode_zbuf function in libavcodec/pngdec.c (boo#1034176)
These non-security issues were fixed:
- Enable ac3
- Enable mp3 decoding
- EBU R128 implementation now within ffmpeg, not relying on external library anymore
- New video filters "premultiply", "readeia608", "threshold", "midequalizer"
- Support for spherical videos
- New decoders: 16.8 and 24.0 floating point PCM, XPM
- New demuxers: MIDI Sample Dump Standard, Sample Dump eXchange demuxer
- MJPEG encoding uses Optimal Huffman tables now
- Native Opus encoder
- Support .mov with multiple sample description tables
- Removed the legacy X11 screen grabber, use XCB instead
- Removed asyncts filter (use af_aresample instead)
-
Submitted by
Jan Engelhardt (jengelh)