About vulnerabilities of FFmpeg and Livav for i.MX6 series BSP.

[satoshishimoda]

Hi community,

I have a question about i.MX6 series BSP.

Please see the following link, the vulnerability of FFmpeg and Livav were reported.

Vulnerability Note VU#772447 - ffmpeg and Libav cross-domain information disclosure vulnerability

Then, I want to confirm whether i.MX6 BSP includes these vulnerability.

I think all revision of i.MX6 Linux and Android BSP include the vulnerability, right?

Or some BSP avoid the vulnerability?

If some BSP avoid it, would you let me know what BSP revision avoid the proble?

Especially, I want to know about jb4.2.2_1.1.0-ga.

Best Regards,

Satoshi Shimoda

[qiang_li-mpu_se · Accepted solution]

Hi Satoshi, for NXP Android BSP, the playlist was not handled by ffmpeg and livav, the media player is our own OMX player, so we think this vulnerability has no impact to our BSP.

[gusarambula]

Thank you, Qiang Li!