remove / compile without libschroedinger, libtheora, libspeex, ...

[Nik Soams]

Package libavcodec ffmpeg should support only most used codecs that are actively developed/maintened.

All other should be moved to libavcoded ffmpeg EXTRA

Consider moving to extra
libschroedinger
libshine
libspeex
libwavpack
libtwolame
libtheora
libcrystalhd
libopenjp2
libwebp
...

The more codecs are installed by default, the bigger surface for exploits

[Carl Eugen Hoyos (cehoyos)]

These libraries are only used for encoding in FFmpeg, removing them from FFmpeg will not reduce the chance for an exploit:
libshine
libspeex
libwavpack
libtwolame
libtheora
libwebp

All other libraries in your list are not the default decoders for any input file, I am not convinced they can be used to exploit issues using FFmpeg or any media player using libavcodec.
Note that as long as these libraries are used by any application in Ubuntu, removing them from FFmpeg will not likely reduce the general chance for an exploit.
So if you feel that libopenjp2 is likely susceptible for security issues, you should vote for its complete removal from Ubuntu, not necessarily from FFmpeg in Ubuntu.

Finally, note that in the past (year), Ubuntu had troubles updating FFmpeg releases, indicating FFmpeg in Ubuntu was vulnerable to known issues (while I assume your list is about theoretical exploits), so if you want to invest time in increasing FFmpeg security in Ubuntu, you should consider helping the packagers.
(I am tempted to point you to known unfixed security issues concerning libavcodec in past but maintained Ubuntu releases but it may be better not to fan the flames here.)

[Andreas Cadhalpun (andreas-cadhalpun)]

This has already been reported before (https://bugs.debian.org/786670) and my opinion hasn't changed:
I don't think these external libraries increase the attack surface much.

The bug I mentioned was closed by disabling the two external libraries that turned out to be problematic, libopenjpeg and libschroedinger.
The issues in openjpeg have been fixed (in openjpeg2), while libschroedinger got removed entirely.

As I don't think there is anything else to be done about this, I'm closing this bug as won't fix.