[kirkstone,14/24] ffmpeg: ignore CVE-2023-6603

Message ID	dcfd5672474f7a9bf7913c0f0e35f7c40bb685c4.1760038088.git.steve@sakoman.com
State	New
Headers	show Return-Path: <steve@sakoman.com> ip: 209.85.210.181, mailfrom: steve@sakoman.com) From: Steve Sakoman <steve@sakoman.com> To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 14/24] ffmpeg: ignore CVE-2023-6603 Date: Thu, 9 Oct 2025 12:30:58 -0700 Message-ID: <dcfd5672474f7a9bf7913c0f0e35f7c40bb685c4.1760038088.git.steve@sakoman.com> In-Reply-To: <cover.1760038088.git.steve@sakoman.com> References: <cover.1760038088.git.steve@sakoman.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[kirkstone,01/24] libxml2: fix CVE-2025-9714 \| expand [kirkstone,01/24] libxml2: fix CVE-2025-9714 [kirkstone,02/24] gstreamer1.0-plugins-bad: Fix CVE-2025-3887 [kirkstone,03/24] busybox: patch CVE-2025-46394 [kirkstone,04/24] libxslt: Patch for CVE-2025-7424 [kirkstone,05/24] tiff: Fix CVE-2025-8961 [kirkstone,06/24] tiff: Fix CVE-2025-9165 [kirkstone,07/24] gstreamer1.0: ignore CVEs fixed in plugins [kirkstone,08/24] gstreamer1.0: ignore CVE-2025-2759 [kirkstone,09/24] grub: ignore CVE-2024-2312 [kirkstone,10/24] ghostscript: patch CVE-2025-59798 [kirkstone,11/24] ghostscript: patch CVE-2025-59799 [kirkstone,12/24] ghostscript: patch CVE-2025-59800 [kirkstone,13/24] pulseaudio: ignore CVE-2024-11586 [kirkstone,14/24] ffmpeg: ignore CVE-2023-6603 [kirkstone,15/24] ffmpeg: mark CVE-2023-6601 as patched [kirkstone,16/24] go: fix CVE-2025-47906 [kirkstone,17/24] scripts/install-buildtools: Update to 4.0.30 [kirkstone,18/24] openssl: upgrade 3.0.17 -> 3.0.18 [kirkstone,19/24] glibc: stable 2.35 branch updates [kirkstone,20/24] systemd: backport fix for handle USE_NLS from master [kirkstone,21/24] p11-kit: backport fix for handle USE_NLS from master [kirkstone,22/24] conf/bitbake.conf: use gnu mirror instead of main server [kirkstone,23/24] selftest/cases/meta_ide.py: use use gnu mirror instead of main server [kirkstone,24/24] oeqa/sdk/cases/buildcpio.py: use gnu mirror instead of main server

Message ID

dcfd5672474f7a9bf7913c0f0e35f7c40bb685c4.1760038088.git.steve@sakoman.com

State

New

Headers

From: Steve Sakoman <steve@sakoman.com>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][kirkstone 14/24] ffmpeg: ignore CVE-2023-6603
Date: Thu,  9 Oct 2025 12:30:58 -0700
Message-ID: 
 <dcfd5672474f7a9bf7913c0f0e35f7c40bb685c4.1760038088.git.steve@sakoman.com>
In-Reply-To: <cover.1760038088.git.steve@sakoman.com>
References: <cover.1760038088.git.steve@sakoman.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[kirkstone,01/24] libxml2: fix CVE-2025-9714 | expand

Commit Message

Steve Sakoman Oct. 9, 2025, 7:30 p.m. UTC

From: Peter Marko <peter.marko@siemens.com>

Per [1] this CVE is fixed by [2] which is available in version 5.0, so
version 5.0.3 is not vulnerable anymore.

[1] https://security-tracker.debian.org/tracker/CVE-2023-6603
[2] https://github.com/FFmpeg/FFmpeg/commit/28c83584e8f3cd747c1476a74cc2841d3d1fa7f3

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.3.bb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.3.bb
index a46cb3480a..d64b97e787 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.3.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.3.bb
@@ -101,6 +101,10 @@  CVE_CHECK_IGNORE += "CVE-2022-3109"
 # bugfix: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/481e81be1271ac9a0124ee615700390c2371bd89
 CVE_CHECK_IGNORE += "CVE-2022-3341"
 
+# This vulnerability was fixed in 5.0
+# bugfix: https://github.com/FFmpeg/FFmpeg/commit/28c83584e8f3cd747c1476a74cc2841d3d1fa7f3
+CVE_CHECK_IGNORE += "CVE-2023-6603"
+
 # Build fails when thumb is enabled: https://bugzilla.yoctoproject.org/show_bug.cgi?id=7717
 ARM_INSTRUCTION_SET:armv4 = "arm"
 ARM_INSTRUCTION_SET:armv5 = "arm"

[kirkstone,14/24] ffmpeg: ignore CVE-2023-6603

Commit Message

Patch