CVE-2023-6602

NameCVE-2023-6602
DescriptionA flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4241-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ffmpeg (PTS)bullseye7:4.3.7-0+deb11u1vulnerable
bullseye (security)7:4.3.9-0+deb11u1fixed
bookworm, bookworm (security)7:5.1.6-0+deb12u1vulnerable
sid, trixie7:7.1.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ffmpegsourcebullseye7:4.3.9-0+deb11u1DLA-4241-1
ffmpegsource(unstable)7:7.1.1-1

Notes

[bookworm] - ffmpeg <postponed> (Minor issue, wait until it's fixed in the 5.1 branch)
https://bugzilla.redhat.com/show_bug.cgi?id=2334338
Fixed by: https://github.com/FFmpeg/FFmpeg/commit/91d96dc8ddaebe0b6cb393f672085e6bfaf15a31 (master)
Fixed by: https://github.com/FFmpeg/FFmpeg/commit/b753bac08f6881b2d3dea8f1ab84c81550f35897 (n7.1.1)

Search for package or bug name: Reporting problems