{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2023-6602", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2023-12-08T06:53:00.458Z", "datePublished": "2024-12-31T14:20:07.379Z", "dateUpdated": "2025-11-03T19:29:02.017Z"}, "containers": {"cna": {"title": "Ffmpeg: improper handling of input format in tty demuxer of ffmpeg", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}], "affected": [{"versions": [{"status": "affected", "version": "2.0", "lessThan": "6.*", "versionType": "semver"}], "packageName": "FFmpeg", "collectionURL": "https://github.com/FFmpeg/FFmpeg", "defaultStatus": "unknown"}], "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334338", "name": "RHBZ#2334338", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2024-02-26T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-99", "description": "Improper Control of Resource Identifiers ('Resource Injection')", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-99: Improper Control of Resource Identifiers ('Resource Injection')", "timeline": [{"lang": "en", "time": "2023-12-06T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-02-26T00:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2025-01-06T15:44:38.131Z"}}, "adp": [{"references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334338", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-31T15:00:28.545684Z", "id": "CVE-2023-6602", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-31T15:00:50.735Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:29:02.017Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:29:02.017Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-6602", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-31T15:00:28.545684Z"}}}], "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334338", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-31T15:00:36.465Z"}}], "cna": {"title": "Ffmpeg: improper handling of input format in tty demuxer of ffmpeg", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"versions": [{"status": "affected", "version": "2.0", "lessThan": "6.*", "versionType": "semver"}], "packageName": "FFmpeg", "collectionURL": "https://github.com/FFmpeg/FFmpeg", "defaultStatus": "unknown"}], "timeline": [{"lang": "en", "time": "2023-12-06T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-02-26T00:00:00.000Z", "value": "Made public."}], "datePublic": "2024-02-26T00:00:00.000Z", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334338", "name": "RHBZ#2334338", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "descriptions": [{"lang": "en", "value": "A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-99", "description": "Improper Control of Resource Identifiers ('Resource Injection')"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2025-01-06T15:44:38.131Z"}, "x_redhatCweChain": "CWE-99: Improper Control of Resource Identifiers ('Resource Injection')"}}, "cveMetadata": {"cveId": "CVE-2023-6602", "state": "PUBLISHED", "dateUpdated": "2025-11-03T19:29:02.017Z", "dateReserved": "2023-12-08T06:53:00.458Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2024-12-31T14:20:07.379Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "matchCriteriaId": "DE670466-3267-48D2-A826-99B23F7FBD12", "versionEndIncluding": "6.0", "versionStartIncluding": "2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en FFmpeg's TTY Demuxer. Esta vulnerabilidad permite la posible exfiltraci\u00f3n de datos mediante el an\u00e1lisis incorrecto de archivos de entrada que no cumplen con los requisitos TTY en las listas de reproducci\u00f3n HLS."}], "id": "CVE-2023-6602", "lastModified": "2025-11-03T20:16:06.973", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "secalert@redhat.com", "type": "Secondary"}]}, "published": "2024-12-31T15:15:06.240", "references": [{"source": "secalert@redhat.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334338"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334338"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-99"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}