Needed security upgrade for ffmpeg in lucid

[Guiodic (Guido Iodice)]

Binary package hint: ffmpeg

Lucid brings ffmpeg 0.5.1 that is affected by several security flaws.

Please check: http://www.ffmpeg.org/releases/ffmpeg-0.5.4.changelog

One of this exploit works surely on ubuntu: http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt

Infacts:

ffplay Kedans.ape
FFplay version SVN-r0.5.1-4:0.5.1-1ubuntu1, Copyright (c) 2003-2009 Fabrice Bellard, et al.
  configuration: --extra-version=4:0.5.1-1ubuntu1 --prefix=/usr --enable-avfilter --enable-avfilter-lavf --enable-vdpau --enable-bzlib --enable-libgsm --enable-libschroedinger --enable-libspeex --enable-libtheora --enable-libvorbis --enable-pthreads --enable-zlib --disable-stripping --disable-vhook --enable-runtime-cpudetect --enable-gpl --enable-postproc --enable-swscale --enable-x11grab --enable-libdc1394 --enable-shared --disable-static
  libavutil 49.15. 0 / 49.15. 0
  libavcodec 52.20. 1 / 52.20. 1
  libavformat 52.31. 0 / 52.31. 0
  libavdevice 52. 1. 0 / 52. 1. 0
  libavfilter 0. 4. 0 / 0. 4. 0
  libswscale 0. 7. 1 / 0. 7. 1
  libpostproc 51. 2. 0 / 51. 2. 0
  built on Mar 4 2010 12:35:30, gcc: 4.4.3
Errore di virgola mobile

[Reinhard Tartler (siretart)]

I'd suggest to include the upstream point releases 0.5.4 and 0.6.2 as they are very focused point releases targeting only at compilation problems and security issues.

if you find any issues such as missing security fixes or other problems, please let me know and I'm happy to handle this upstream.

[Marc Deslauriers (mdeslaur)]

Updated have been published for these issues.
USN-1104-1.

[Guiodic (Guido Iodice) (guido-iodice)]

Thank you.

FFmpeg needs be updated in medibuntu too.

[Tom rooze.sen (tomrooze-sen)]

[URL=http://img155.imageshack.us/i/schermafdrukz.png/][IMG]http://img155.imageshack.us/img155/9823/schermafdrukz.th.png[/IMG][/URL]

Nichts zu machen ,kan die nicht installieren und ich bin nicht die einzige .
Noch sieben personen sitzen damit bei uns auf das forum.
Kan jetzt auch kein Winff mehr installieren und ein teil vom VLC fehlt jetzt.
Keine schone sache.
Grus Tom.

[Tom rooze.sen (tomrooze-sen)]

FFmpeg probleim = OKE.
Many thanks good job ... great.
Greetings Tom.

[Gauvain Pocentek (gpocentek)]

Updated packages have been published in the medibuntu -staging repos.

[Guiodic (Guido Iodice) (guido-iodice)]

@gauvain: can I have the deb line for medibuntu -stagin repos? I would like to test the updated packages.

[Gauvain Pocentek (gpocentek)]

Guido,

Just copy the current medibuntu deb line in /etc/apt/sources.list.d/medibuntu.list, but replace "lucid" with "lucid-staging".
Thanks for the test.

[Guiodic (Guido Iodice) (guido-iodice)]

@Gauvain: the upgrade works fine.