Bug#570713: ffmpeg: remaining vulnerabilities from bug #550442

2010-02-26 Thread Reinhard Tartler
On Sa, Feb 20, 2010 at 22:02:51 (CET), Michael Gilbert wrote: > package: ffmpeg > version: 0.svn20080206-18 > severity: serious > tags: security > > hi, i have just tested the latest ffmpeg update against the original > proof of concepts [0] reported in bug #550442 [1]. many of them are > still e

Bug#570713: ffmpeg: remaining vulnerabilities from bug #550442

2010-02-22 Thread Moritz Muehlenhoff
Reinhard Tartler wrote: > I don't think its really worth tracking dos-only fixes. FFmpeg is very > performance tuned, and AFAIUI upstream does consider dos-only fixes only > on a best efford basis as long as it doesn't impair performance. Ack. Crashers in media libs are not treated as security rel

Bug#570713: ffmpeg: remaining vulnerabilities from bug #550442

2010-02-21 Thread Reinhard Tartler
On Sa, Feb 20, 2010 at 22:02:51 (CET), Michael Gilbert wrote: > package: ffmpeg > version: 0.svn20080206-18 > severity: serious > tags: security > > hi, i have just tested the latest ffmpeg update against the original > proof of concepts [0] reported in bug #550442 [1]. many of them are > still e

Bug#570713: ffmpeg: remaining vulnerabilities from bug #550442

2010-02-20 Thread Michael Gilbert
package: ffmpeg version: 0.svn20080206-18 severity: serious tags: security hi, i have just tested the latest ffmpeg update against the original proof of concepts [0] reported in bug #550442 [1]. many of them are still effective. there is some good news though; i've found that upstream has addres