CVE-2017-9993

CVE-2017-9993

Published · Updated

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 16%
exploitation probability
16%top 3% of all CVEs
observed exploitation
nono source reports it
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
Affected products
n/a · n/a
References
https://github.com/FFmpeg/FFmpeg/commit/189ff4219644532bdfa7bab28dfedaee4d6d4021https://github.com/FFmpeg/FFmpeg/commit/a5d849b149ca67ced2d271dc84db0bc95a548abbhttps://lists.debian.org/debian-lts-announce/2019/01/msg00006.htmlhttp://www.debian.org/security/2017/dsa-3957http://www.securityfocus.com/bid/99315