From 6dc1c726967e7d99d63b642c2558a3b94e778e9c Mon Sep 17 00:00:00 2001 From: Giulio Benetti Date: Tue, 5 May 2026 21:58:34 +0200 Subject: [PATCH] package/ffmpeg: securty bump version to 6.1.5 Fixes: CVE-2026-30997 - FFmpeg AV1 Decoding Out-of-Bounds Read Vulnerability [1] Full changelog: https://code.ffmpeg.org/FFmpeg/FFmpeg/src/tag/n6.1.5/Changelog License file hash changed due to removing U+000C unicode characters in [2]. [1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a44ab44236a99ae26594fb3e14fe0c956210673d [2] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/735acddb8a12e9de2fb6ad92ece4422fe5a6a02e Signed-off-by: Giulio Benetti [Marcus: mention security fix, use upstream url for changelog instead of videolan mirror] Signed-off-by: Marcus Hoffmann (cherry picked from commit 6cd936b8e72cf26a6024a8ecfa23345bbb22a608) Signed-off-by: Thomas Perale --- package/ffmpeg/ffmpeg.hash | 4 ++-- package/ffmpeg/ffmpeg.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/ffmpeg/ffmpeg.hash b/package/ffmpeg/ffmpeg.hash index 1ffef61309..4c489f168c 100644 --- a/package/ffmpeg/ffmpeg.hash +++ b/package/ffmpeg/ffmpeg.hash @@ -1,5 +1,5 @@ # Locally calculated -sha256 a231e3d5742c44b1cdaebfb98ad7b6200d12763e0b6db9e1e2c5891f2c083a18 ffmpeg-6.1.4.tar.xz +sha256 05fbe9db1f5452a3605bb1d9bf91da9d4bb08162891692e4f172b58c49109412 ffmpeg-6.1.5.tar.xz sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING.GPLv2 -sha256 b634ab5640e258563c536e658cad87080553df6f34f62269a21d554844e58bfe COPYING.LGPLv2.1 +sha256 246041b6ecf9bc32d718a62c57877c78b5eb397b6467e74ed7ae2626ab189c30 COPYING.LGPLv2.1 sha256 cb48bf09a11f5fb576cddb0431c8f5ed0a60157a9ec942adffc13907cbe083f2 LICENSE.md diff --git a/package/ffmpeg/ffmpeg.mk b/package/ffmpeg/ffmpeg.mk index 798bc46b9f..d9f0d591d1 100644 --- a/package/ffmpeg/ffmpeg.mk +++ b/package/ffmpeg/ffmpeg.mk @@ -4,7 +4,7 @@ # ################################################################################ -FFMPEG_VERSION = 6.1.4 +FFMPEG_VERSION = 6.1.5 FFMPEG_SOURCE = ffmpeg-$(FFMPEG_VERSION).tar.xz FFMPEG_SITE = https://ffmpeg.org/releases FFMPEG_INSTALL_STAGING = YES