Skip to main content

Improper Control of Resource Identifiers ('Resource Injection')

CVE-2023-6602

Medium
5.3/10

Summary

A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists. This issue affects versions n3.4 through n4.2.10, n4.3 through n4.3.8, 4.4 through n4.4.5, n5.0 through n5.1.6, n5.2-dev, 6.0 through n6.1.2, n6.2-dev, n7.0 through n7.0.2, n7.1-dev through n7.1, and n7.2-dev.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')

The software receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

References

Advisory Timeline

  • Published