Baptoutatis

FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls read header(), causing unbounded CPU and I/O consumption.

FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff rtsp connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core.

FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse playlist() open resources the HLS security policy should block.

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff rtsp connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol whitelist, to probe internal network services.

**Name of the Vulnerable Software and Affected Versions** Temporary Login Without Password versions prior to 1.9.9 **Description** The plugin fails to verify if the user requesting a temporary login possesses network super admin rights before granting those privileges to the new account. This flaw allows an administrator of a single site within a multisite network to gain control over the entire network. Additionally, the lack of this check enables the promotion of existing accounts, including those belonging to an attacker. **Recommendations** Update to version 1.9.9 or later.

**Name of the Vulnerable Software and Affected Versions** Temporary Login Without Password versions prior to 1.9.9 **Description** The plugin fails to prevent temporary users from creating an Application Password and does not revoke these passwords when temporary access expires or is disabled. This allows a user to maintain access to the site via REST and XML-RPC interfaces after their temporary access has been withdrawn. The persistent access retains the assigned user role, which is typically Administrator. **Recommendations** Update to version 1.9.9 or later.