diff --git a/poky/meta/recipes-multimedia/ffmpeg/ffmpeg_4.1.1.bb b/poky/meta/recipes-multimedia/ffmpeg/ffmpeg_4.1.3.bb
similarity index 97%
rename from poky/meta/recipes-multimedia/ffmpeg/ffmpeg_4.1.1.bb
rename to poky/meta/recipes-multimedia/ffmpeg/ffmpeg_4.1.3.bb
index 749b3d0..994a792 100644
--- a/poky/meta/recipes-multimedia/ffmpeg/ffmpeg_4.1.1.bb
+++ b/poky/meta/recipes-multimedia/ffmpeg/ffmpeg_4.1.3.bb
@@ -26,8 +26,8 @@
 SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \
            file://mips64_cpu_detection.patch \
            "
-SRC_URI[md5sum] = "720fc84617a2c38aeae79aff3689a567"
-SRC_URI[sha256sum] = "373749824dfd334d84e55dff406729edfd1606575ee44dd485d97d45ea4d2d86"
+SRC_URI[md5sum] = "dcc20dd2682ea01c678b7b8324339d43"
+SRC_URI[sha256sum] = "0c3020452880581a8face91595b239198078645e7d7184273b8bcc7758beb63d"
 
 # Build fails when thumb is enabled: https://bugzilla.yoctoproject.org/show_bug.cgi?id=7717
 ARM_INSTRUCTION_SET_armv4 = "arm"
diff --git a/poky/meta/recipes-multimedia/flac/flac_1.3.2.bb b/poky/meta/recipes-multimedia/flac/flac_1.3.2.bb
index 92ef897..e8599f6 100644
--- a/poky/meta/recipes-multimedia/flac/flac_1.3.2.bb
+++ b/poky/meta/recipes-multimedia/flac/flac_1.3.2.bb
@@ -21,7 +21,7 @@
 SRC_URI[md5sum] = "454f1bfa3f93cc708098d7890d0499bd"
 SRC_URI[sha256sum] = "91cfc3ed61dc40f47f050a109b08610667d73477af6ef36dcad31c31a4a8d53f"
 
-CVE_PRODUCT = "libflac"
+CVE_PRODUCT = "libflac flac"
 
 inherit autotools gettext
 
diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.14.4.bb b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.14.4.bb
index 4987be8..23d093d 100644
--- a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.14.4.bb
+++ b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.14.4.bb
@@ -20,7 +20,7 @@
 
 DEPENDS += "gstreamer1.0-plugins-base"
 
-inherit gettext bluetooth
+inherit gettext bluetooth gobject-introspection
 
 PACKAGECONFIG ??= " \
     ${GSTREAMER_ORC} \
diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.14.4.bb b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.14.4.bb
index 12c9bbc..f3e6daf 100644
--- a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.14.4.bb
+++ b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.14.4.bb
@@ -28,7 +28,7 @@
 
 DEPENDS += "iso-codes util-linux"
 
-inherit gettext
+inherit gettext gobject-introspection
 
 PACKAGES_DYNAMIC =+ "^libgst.*"
 
diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins.inc b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins.inc
index 5906e4a..bc24b05 100644
--- a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins.inc
+++ b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins.inc
@@ -7,7 +7,7 @@
 
 SRC_URI_append = " file://gtk-doc-tweaks.patch"
 
-inherit autotools pkgconfig upstream-version-is-even gobject-introspection gtk-doc
+inherit autotools pkgconfig upstream-version-is-even gtk-doc
 
 acpaths = "-I ${S}/common/m4 -I ${S}/m4"
 
diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.14.4.bb b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.14.4.bb
index 8d45ca2..048aaf4 100644
--- a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.14.4.bb
+++ b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.14.4.bb
@@ -16,7 +16,11 @@
 
 S = "${WORKDIR}/${PNREAL}-${PV}"
 
-inherit autotools pkgconfig distutils3-base upstream-version-is-even gobject-introspection
+# gobject-introspection is mandatory and cannot be configured
+REQUIRED_DISTRO_FEATURES = "gobject-introspection-data"
+UNKNOWN_CONFIGURE_WHITELIST_append = " --enable-introspection --disable-introspection"
+
+inherit autotools pkgconfig distutils3-base upstream-version-is-even gobject-introspection distro_features_check
 
 do_install_append() {
     # gstpythonplugin hardcodes the location of the libpython from the build
diff --git a/poky/meta/recipes-multimedia/libpng/libpng/CVE-2019-7317.patch b/poky/meta/recipes-multimedia/libpng/libpng/CVE-2019-7317.patch
deleted file mode 100644
index 6ee1f8d..0000000
--- a/poky/meta/recipes-multimedia/libpng/libpng/CVE-2019-7317.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-Use-after-free detected with static analysis.
-
-CVE: CVE-2019-7317
-Upstream-Status: Submitted [https://github.com/glennrp/libpng/issues/275]
-Signed-off-by: Ross Burton <ross.burton@intel.com>
-
-diff --git a/png.c b/png.c
-index 9d9926f638..efd1aecfbd 100644
---- a/png.c
-+++ b/png.c
-@@ -4588,8 +4588,7 @@ png_image_free(png_imagep image)
-    if (image != NULL && image->opaque != NULL &&
-       image->opaque->error_buf == NULL)
-    {
--      /* Ignore errors here: */
--      (void)png_safe_execute(image, png_image_free_function, image);
-+      png_image_free_function(image);
-       image->opaque = NULL;
-    }
- }
diff --git a/poky/meta/recipes-multimedia/libpng/libpng_1.6.36.bb b/poky/meta/recipes-multimedia/libpng/libpng_1.6.37.bb
similarity index 70%
rename from poky/meta/recipes-multimedia/libpng/libpng_1.6.36.bb
rename to poky/meta/recipes-multimedia/libpng/libpng_1.6.37.bb
index a586237..66af2f3 100644
--- a/poky/meta/recipes-multimedia/libpng/libpng_1.6.36.bb
+++ b/poky/meta/recipes-multimedia/libpng/libpng_1.6.37.bb
@@ -2,17 +2,16 @@
 HOMEPAGE = "http://www.libpng.org/"
 SECTION = "libs"
 LICENSE = "Libpng"
-LIC_FILES_CHKSUM = "file://LICENSE;md5=12b4ec50384c800bc568f519671b120c \
-                    file://png.h;endline=144;md5=15ae15f53376306868259924a9db4e05 \
+LIC_FILES_CHKSUM = "file://LICENSE;md5=b0085051bf265bac2bfc38bc89f50000\
+                    file://png.h;endline=144;md5=8acd23d544623816b097e07be0139509\
                     "
 DEPENDS = "zlib"
 
 LIBV = "16"
 
-SRC_URI = "${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/${PV}/${BP}.tar.xz \
-           file://CVE-2019-7317.patch"
-SRC_URI[md5sum] = "df2be2d29c40937fe1f5349b16bc2826"
-SRC_URI[sha256sum] = "eceb924c1fa6b79172fdfd008d335f0e59172a86a66481e09d4089df872aa319"
+SRC_URI = "${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/${PV}/${BP}.tar.xz"
+SRC_URI[md5sum] = "015e8e15db1eecde5f2eb9eb5b6e59e9"
+SRC_URI[sha256sum] = "505e70834d35383537b6491e7ae8641f1a4bed1876dbfe361201fc80868d88ca"
 
 MIRRORS += "${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/${PV}/ ${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/older-releases/${PV}/"
 
diff --git a/poky/meta/recipes-multimedia/mpg123/mpg123/sdl2.patch b/poky/meta/recipes-multimedia/mpg123/mpg123/sdl2.patch
new file mode 100644
index 0000000..9dc9b92
--- /dev/null
+++ b/poky/meta/recipes-multimedia/mpg123/mpg123/sdl2.patch
@@ -0,0 +1,14 @@
+Use libsdl2 instead of libsdl 1.2, which is dead upstream.
+
+Luckily the API that mpg123 use didn't change so this is a trivial change.
+
+Upstream-Status: Submitted [https://sourceforge.net/p/mpg123/bugs/268/]
+Signed-off-by: Ross Burton <ross.burton@intel.com>
+
+diff --git a/configure.ac b/configure.ac
+index 6216d4f..b8d3344 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1694 +1694 @@ do
+-			PKG_CHECK_MODULES(SDL, sdl, output_modules="$output_modules sdl" HAVE_SDL="yes", HAVE_SDL="no" check_failed=yes)
++			PKG_CHECK_MODULES(SDL, sdl2, output_modules="$output_modules sdl" HAVE_SDL="yes", HAVE_SDL="no" check_failed=yes)
diff --git a/poky/meta/recipes-multimedia/mpg123/mpg123_1.25.10.bb b/poky/meta/recipes-multimedia/mpg123/mpg123_1.25.10.bb
index ff2b7d8..dfb10bb 100644
--- a/poky/meta/recipes-multimedia/mpg123/mpg123_1.25.10.bb
+++ b/poky/meta/recipes-multimedia/mpg123/mpg123_1.25.10.bb
@@ -9,7 +9,8 @@
 LICENSE = "LGPLv2.1"
 LIC_FILES_CHKSUM = "file://COPYING;md5=1e86753638d3cf2512528b99079bc4f3"
 
-SRC_URI = "https://www.mpg123.de/download/${BP}.tar.bz2"
+SRC_URI = "https://www.mpg123.de/download/${BP}.tar.bz2 \
+           file://sdl2.patch"
 SRC_URI[md5sum] = "ea32caa61d41d8be797f0b04a1b43ad9"
 SRC_URI[sha256sum] = "6c1337aee2e4bf993299851c70b7db11faec785303cfca3a5c3eb5f329ba7023"
 
@@ -27,7 +28,7 @@
 PACKAGECONFIG[openal] = ",,openal-soft"
 PACKAGECONFIG[portaudio] = ",,portaudio-v19"
 PACKAGECONFIG[pulseaudio] = "--with-default-audio=pulse,,pulseaudio"
-PACKAGECONFIG[sdl] = ",,libsdl"
+PACKAGECONFIG[sdl] = ",,libsdl2"
 
 # Following are possible sound output modules:
 # alsa arts coreaudio dummy esd jack nas openal os2 oss portaudio pulse sdl sndio sun tinyalsa win32 win32_wasapi