Re: [PATCH 6/6] ffmpeg: set status for 5 CVEs

[Benjamin Robin <benjamin.robin@bootlin.com>]

Hello Peter,

On Sunday, April 26, 2026 at 8:50 PM, Peter Marko wrote:
> From: Peter Marko <peter.marko@siemens.com>
> 
> These reappeared after update of sbom-cve-check tooling.
> Fixed version found by links from Debian security tracker.
> 
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> ---
>  meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.1.bb | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.1.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.1.bb
> index 7bb7de3d25..9780abe184 100644
> --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.1.bb
> +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.1.bb
> @@ -176,6 +176,11 @@ CVE_STATUS_GROUPS = "CVE_STATUS_WRONG_CPE"
>  CVE_STATUS_WRONG_CPE = "CVE-2023-51791 CVE-2023-51793 CVE-2023-51794 CVE-2023-51795 CVE-2023-51796 CVE-2023-51797 CVE-2023-51798 CVE-2025-22921"
>  CVE_STATUS_WRONG_CPE[status] = "fixed-version: these CVEs are fixed in used version"
>  
> +CVE_STATUS[CVE-2022-2566] = "fixed-version: these CVEs are fixed since v5.1.1"
> +CVE_STATUS[CVE-2025-9951] = "fixed-version: these CVEs are fixed since v8.0"
>  CVE_STATUS[CVE-2025-25468] = "fixed-version: these CVEs are fixed since v8.0"
>  CVE_STATUS[CVE-2025-25469] = "fixed-version: these CVEs are fixed since v8.0"
>  CVE_STATUS[CVE-2025-12343] = "fixed-version: this CVE are fixed since v8.0"
> +CVE_STATUS[CVE-2025-59729] = "fixed-version: this CVE are fixed since v8.0"
> +CVE_STATUS[CVE-2025-59730] = "fixed-version: this CVE are fixed since v8.0"

> +CVE_STATUS[CVE-2025-69693] = "fixed-version: this CVE are fixed since v8.1"

Why the CVE-2025-69693 is marked has fixed?

It is affecting the version 8.0.1 which is the current version of the recipe,
as reported by NVD:
https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-69693

{ vulnerable: true, criteria: "cpe:2.3:a:ffmpeg:ffmpeg:8.0.1:*:*:*:*:*:*:*", 
  matchCriteriaId: "7F5CACA2-6FB6-4D6D-92D0-C9FF0E7CDB14" }

I did not investigate in which version this CVE was fixed.

-- 
Benjamin Robin, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com