Package
ffmpeg-9.0
Component
ffmpeg-9.0
Latest update
Fixed version
9.0.1-r0
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
9.0.1-r0Impact
Fixed in the 9.0.1 release by release/9.0 commit 999f8ba75ce0, a backport of master commit 65b0dab903e5 ("avformat/dashdec: reject a negative fragment index"). The commit is an ancestor of tag n9.0.1 and not of n9.0. The first apk built from n9.0.1 is 9.0.1-r0, and the compiled get_current_fragment bounds check differs from 9.0-r0 (unsigned range check instead of signed). Scanners still match because the CVE affected range is an unbounded git commit range.
Status