CVE-2023-6605

NameCVE-2023-6605
DescriptionA flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4241-1, DSA-5985-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ffmpeg (PTS)bullseye7:4.3.7-0+deb11u1vulnerable
bullseye (security)7:4.3.9-0+deb11u1fixed
bookworm, bookworm (security)7:5.1.7-0+deb12u1fixed
forky, sid, trixie7:7.1.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ffmpegsourcebullseye7:4.3.9-0+deb11u1DLA-4241-1
ffmpegsourcebookworm7:5.1.7-0+deb12u1DSA-5985-1
ffmpegsource(unstable)7:7.1.1-1

Notes

[bookworm] - ffmpeg <postponed> (Minor issue, wait until it's fixed in the 5.1 branch)
https://bugzilla.redhat.com/show_bug.cgi?id=2334336
Fixed by: https://github.com/FFmpeg/FFmpeg/commit/4c96d6bf75357ab13808efc9f08c1b41b1bf5bdf (master)
Fixed by: https://github.com/FFmpeg/FFmpeg/commit/c3c7ecfe48d464a0b06564f2e92504b1d9c91d69 (n7.1.1)
Fixed by: https://github.com/FFmpeg/FFmpeg/commit/097131a6474bd6294ff337fa92025df60dff907a (n5.1.7)

Search for package or bug name: Reporting problems