Viewing profile — ChALkeR

The correct figure is 10%.

Done: https://news.ycombinator.com/item?id=10909727

I tried hard to cover all the possible question. Please, read the post _carefully_ before asking or proposing anything.

Note: this actually means that everyone should regenerate all their key-pairs after updating.

And no, switching Buffer(number) to be zero-filled will bring more harm now, even from the security point of view. The best course of action imo is to deprecate Buffer(number) what…

This note does not have anything actually new, but I have seen several people who are not aware of that.

Looks like it bundles libavformat internally.

By the way, mplayer is also affected, even after installing a fixed version of ffmpeg.

It does not, that's covered in the original article.

But that code that you linked to does not verify that the file is mp4, moreover, mp4Sig call is commented out.

Tell me if I should not have double-posted it here, I will delete one of those posts then.

Re-posted as https://news.ycombinator.com/item?id=10895872

Short English description: ffmpeg vulnerability allows reading local files and sending them over network using a specially crafted video file. This affects not only file conversion…

Previosly posted as https://news.ycombinator.com/item?id=10893301 , but that eneded up in [ask] due to my mistake.

https://translate.google.com/translate?sl=ru&tl=en&u=http%3A... will work better, I suppose.

Should I post this again with a link so it ends up in the news or not?

Hm. Why did this end up in [ask]? Perhaps I made a mistake when posting this =).

It's «PC» as in «server»/«PC», not as in «mac»/«PC».

ffmpeg vulnerability allows reading local files and sending them over network using a specially crafted video file. This affects not only file conversion (including thumbnail gener…