From f61eb0f68df841f887dfea01f1ebbe01d69152ab Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Fri, 20 Feb 2026 19:34:54 +0100 Subject: [PATCH] ffmpeg: set status of CVE-2025-25468 and CVE-2025-25469 These CVEs have the same fix commit per NVD report [3]. Blaming the fix [1] is showing that the return without freeing memory was introduced in [2]. [1] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/d5873be583ada9e1fb887e2fe8dcfd4b12e0efcd [2] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/d38fc25519cf12a9212dadcba1258fc176ffbade [3] https://nvd.nist.gov/vuln/detail/CVE-2025-25468 (From OE-Core rev: 67d722ea17ef92e70bfcffbeaba52ddf55d5888a) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker --- meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.3.bb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.3.bb index d64b97e787..4793035eb7 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.3.bb @@ -105,6 +105,11 @@ CVE_CHECK_IGNORE += "CVE-2022-3341" # bugfix: https://github.com/FFmpeg/FFmpeg/commit/28c83584e8f3cd747c1476a74cc2841d3d1fa7f3 CVE_CHECK_IGNORE += "CVE-2023-6603" +# These vulnerabilities were introduced in v8.0 +# introduced: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/d38fc25519cf12a9212dadcba1258fc176ffbade +# bugfix: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/d5873be583ada9e1fb887e2fe8dcfd4b12e0efcd +CVE_CHECK_IGNORE += "CVE-2025-25468 CVE-2025-25469" + # Build fails when thumb is enabled: https://bugzilla.yoctoproject.org/show_bug.cgi?id=7717 ARM_INSTRUCTION_SET:armv4 = "arm" ARM_INSTRUCTION_SET:armv5 = "arm"