CVE-2023-6605

EUVD-2023-58828
A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs.
Resource Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.2 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 30.54%
Affected Products (NVD)
VendorProductVersion
ffmpegffmpeg
2.0 ≤
𝑥
≤ 6.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ffmpeg
bookworm
7:5.1.9-0+deb12u1
fixed
bookworm (security)
7:5.1.9-0+deb12u1
fixed
bullseye
vulnerable
bullseye (security)
7:4.3.9-0+deb11u2
fixed
forky
7:8.1.2-2
fixed
sid
7:8.1.2-2
fixed
trixie
7:7.1.5-0+deb13u1
fixed
trixie (security)
7:7.1.5-0+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ffmpeg
bionic
ignored
focal
Fixed 7:4.2.7-0ubuntu0.1+esm11
released
jammy
Fixed 7:4.4.2-0ubuntu0.22.04.1+esm10
released
noble
Fixed 7:6.1.1-3ubuntu5+esm6
released
oracular
ignored
plucky
ignored
questing
ignored
resolute
needed
xenial
needed
libav
focal
dne
jammy
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
resolute
dne
trusty
needs-triage
Common Weakness Enumeration
References
https://bugzilla.redhat.com/show_bug.cgi?id=2334336
https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html