There are 2 open security issues in buster.
2 issues left for the package maintainer to handle:
- CVE-2020-35964:
(postponed; to be fixed through a stable update)
track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing.
- CVE-2020-35965:
(postponed; to be fixed through a stable update)
decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations.
You can find information about how to handle these issues in the security team's documentation.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/f/ffmpeg.png){kind=link}