CVE-2023-6605
Published: 06 January 2025
Description
A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs.
Security Summary
CVE-2023-6605 is a vulnerability in FFmpeg's DASH playlist support that enables arbitrary HTTP GET requests to be issued on behalf of the machine running FFmpeg. This flaw is triggered by processing a crafted DASH playlist containing malicious URLs. The affected software is FFmpeg, with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and is associated with CWE-99.
Remote unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. By supplying a malicious DASH playlist to an FFmpeg instance, attackers cause it to perform HTTP GET requests to attacker-specified URLs, potentially enabling server-side request forgery scenarios that impact confidentiality and integrity with a changed scope.
Advisories detailing patches and mitigations are available from Red Hat Bugzilla at https://bugzilla.redhat.com/show_bug.cgi?id=2334336 and the Debian LTS announcement at https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html.
Details
- CWE(s)