yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

SummaryA vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files such as .desktop, .url, .webloc to the user's filesystem, bypassing the remediation for CVE-2024-38519. DetailsThe fix for CVE-2024-38519 enforced an allowlist for file extensions, in order ...

CVE-2023-6601 Ffmpeg: hls unsafe file extension bypass in ffmpeg

A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions...

CVE-2023-6601 Ffmpeg: hls unsafe file extension bypass in ffmpeg

A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions...

CVE-2023-6601

CVE-2023-6601 is a vulnerability in FFmpeg’s HLS demuxer that enables bypassing unsafe file extension checks and triggering arbitrary demuxers via base64 data URIs with specific extensions. Public details in the provided connected advisories attribute the issue to FFmpeg and acknowledge fixes in ...