NetSight
IP …
high7.5

CVE-2017-9993

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensio…

Impact

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.

Affected products

VendorProductAffected versions
FfmpegFfmpeg
before 2.8.12
from 3.0 before 3.1.9
from 3.2 before 3.2.6
from 3.3 before 3.3.2
DebianDebian Linux
Versions 8.0, 9.0

Weakness classification

CWE-200

References