CVE-2023-6602

What it actually does

Improper parsing of non-TTY-compliant input files in HLS playlists within FFmpeg's TTY Demuxer enables possible data exfiltration.

Why it matters to the business

Organizations relying on media processing pipelines face risk of sensitive data leakage, potentially leading to compliance issues or data breaches, though low exploitability and lack of known campaigns reduce immediate urgency.

How an attack unfolds

An attacker supplies a crafted HLS playlist containing non-TTY-compliant input to an FFmpeg instance, triggering the flawed TTY Demuxer to mishandle parsing and leak data.

How to fix it

Upgrade affected OpenSSL packages on Ubuntu 14.04 LTS to 1.0.1f-1ubuntu2.20 and on Ubuntu 16.04 LTS to 1.0.2g-1ubuntu4.4; apply equivalent fixes for FFmpeg TTY Demuxer in media workflows.

How to confirm the fix worked

Verify package versions match the listed fixed releases and test HLS playlist parsing with non-TTY inputs to confirm no data leakage occurs.

Typical attack path

1. Identify FFmpeg instances processing HLS content
2. Craft malicious non-TTY input embedded in HLS playlist
3. Deliver playlist to trigger processing
4. Exfiltrate data via the parsing flaw

How to detect it

Review application logs for unusual HLS playlist processing events and monitor for unexpected data flows during media demuxing.

What your security team should do

• Prioritize upgrades on systems processing untrusted media content
• Monitor for updates to FFmpeg in media pipelines
• Review HLS input sources for untrusted playlists