CVE-2023-6603: 
Ffmpeg vulnerability analysis and mitigation

A flaw was found in FFmpeg's HLS playlist parsing that affects multiple versions of FFmpeg. This vulnerability (CVE-2023-6603) allows a denial of service attack through a maliciously crafted HLS playlist that triggers a null pointer dereference during initialization (Red Hat Bugzilla).

The vulnerability exists in FFmpeg versions 3.0 through 5.0 and occurs during the parsing of HLS playlists. When processing an HLS playlist, FFmpeg prior to version 5.0 does not check the return value of new_init_section(). When this function encounters an error, it returns NULL, leading to a null pointer dereference when members cur_init_section are accessed (Red Hat Bugzilla).

The vulnerability can result in a reliable crash of FFmpeg when processing maliciously crafted input files, potentially leading to a denial of service condition. When triggered, the application will crash with a segmentation fault on Linux systems (Red Hat Bugzilla).

The vulnerability has been fixed in FFmpeg version 5.0 through a commit that implements proper checking of the return value from new_init_section(). Users should upgrade to FFmpeg version 5.0 or later to mitigate this vulnerability (Red Hat Bugzilla).