Ubuntu’s current LTS version (24.04) contains ffmpeg version 7:6.1.1-3ubuntu5 which has this buffer overflow vulnerability:
https://trac.ffmpeg.org/ticket/10952
https://ubuntu.com/security/CVE-2024-32230
On my only Ubuntu computer, my update widget says that I need to upgrade to ffmpeg version 7:6.1.1-3ubuntu5+esm2 but can only only do so with Ubuntu Pro. I’m not eligible for Ubuntu Pro.
Ubuntu claims that 24.04 is currently fully supported, and should have complete security updates. However, they seem to have paywalled this security update.
What should I do?
Anybody can get Ubuntu Pro for free on up to five devices: https://ubuntu.com/pro/subscribe
Why Ubuntu pro when you can have Linux Mint for free indefinitely
Ubuntu pro provides support after 5 years of standard LTS support. Linux Mint does not provide any support (paid nor free) after the first 5 years so the comparison does not really make sense.
Does mint ship with a fixed version of ffmpeg?
Ubuntu shipped ads from Amazon back in the late 00s. I stopped using them then and haven’t touched them since.
Thank you so much for your useful input.
Glad to help. I’m highly suspicious of any corporation backed distributions.
Yes. Ubuntu has two main repos, main and universe.
main is relatively small and includes everything that comes with Ubuntu by default. Canonical secures this repo with security fixes for everyone.
universe is not officially supported by Canonical. It’s updates are done by community members. However, Ubuntu started a service called Ubuntu Pro / ESM that provides updates for packages in universe. It’s opt in because Canonical wants companies using Ubuntu to pay for Pro in order to help fund Ubuntu. However, Pro is also free for personal use on up to 5 machines, so there’s no reason not to enable it. f it was enabled by default then no one would pay for it.
Thanks for the info, I’d seen the pro option but just assumed I didn’t want it, like pretty much everything thing else labelled “pro”.
My issue is that I don’t want to have to register for shit like that. If it’s security related, and it’s a free Linux distro (e.g. not RHEL, etc), it is absolutely not appropriate to diminish anonymity in exchange for those updates, or to paywall them.
It’s hardly diminishing your anonymity. There are plenty of services to create an anonymous email account.
This is a very accurate explanation. ☝️
And people ask me “why” when I chose LMDE over Ubuntu-based Linux Mint.
This shit is why. Canonical is huffing their own farts at this point. Don’t dangle shit in front of me if it comes at a price. And yes, I know Linux Mint isn’t under Canonical, but at this point I would rather not support anything Ubuntu-related.
You only get security updates for packages in main. If you want them for packages in universe, like ffmpeg, you have to use esm or upgrade to 24.10.
That’s not quite accurate. The community can still upload fixed packages to
universe, just as the community runsuniversein the first place.
It’s the difference in OS version;
- 24.04 has ffmpeg_6.1.1-3ubuntu5
- 24.10 has ffmpeg_7.0.2-3ubuntu1
So if you want ffmpeg from main, upgrade to 24.10, otherwise you can only get ffmpeg in 24.04 by waiting until its added to main, using Ubuntu Pro, or compiling from source.
ffmpeg is not in main in any version
All distros have security vulnerabilities. It’s the nature of software. Minimizing the risk is the best you can do.
You’re technically correct, but missing the point of the post. Canonical is withholding a security patch to extort a subscription.
