Threats Tagged 'oesa-2026-4475'

Multiple security vulnerabilities have been identified in FFmpeg versions before 8.1.3 and 9.x before 9.0.2. These include improper certificate validation that skips hostname checks for IP-address hosts, missing host key verification in the SFTP protocol handler, and several denial of service vulnerabilities caused by infinite loops in the DASH demuxer, HLS demuxer, and RTSP redirect handling. Additionally, a protection mechanism failure in the HLS demuxer allows bypassing protocol restrictions. These issues can lead to interception and tampering of streams, impersonation of SFTP servers, denial of service through resource exhaustion, and unauthorized resource access. Patches are available to address these vulnerabilities.