Package
ffmpeg-8.1
Component
ffmpeg-8.1
Latest update
Fixed version
8.1.3-r0
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
8.1.3-r0Impact
Fixed in the 8.1.3 release by release/8.1 commit 62d4ca1f3ead, a backport of master commit 65b0dab903e5 ("avformat/dashdec: reject a negative fragment index"). The commit is an ancestor of tag n8.1.3 and not of n8.1.2. The first apk built from n8.1.3 is 8.1.3-r0, and the compiled get_current_fragment bounds check differs from 8.1.2-r4 (unsigned range check instead of signed). Scanners still match because the CVE affected range is an unbounded git commit range.
Status