CVE-2016-1897
published 2016-01-15CVE-2016-1897: FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8…
PriorityP336medium5.5CVSS 3.0
AVLACLPRNUIRSUCHINAN
EPSS
14.62%
96.2th percentile
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
Affected
88 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| debian | ffmpeg | < ffmpeg 7:2.8.5-1 (bookworm) | ffmpeg 7:2.8.5-1 (bookworm) |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect use of the 'concat' protocol within HLS M3U8 files processed by FFmpeg, which is the attack vector for this CVE ↗
- →Monitor outbound HTTP requests from FFmpeg processes where the URL contains file content (first line of a local file), indicating successful SSRF/cross-origin file read exploitation ↗
- ·Vulnerability is scoped as 'local' by Debian; affected versions are FFmpeg 2.x. Fixed in FFmpeg 2.8.5-1 across Debian stable/testing/unstable tracks. ↗
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv5.5MEDIUM
vendor_debian5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Libav vulnerabilities
vendor_ubuntu·2016-04-04
CVE-2014-8541 Libav vulnerabilities
Title: Libav vulnerabilities
Summary: Libav could be made to crash or run programs as your login if it opened a
specially crafted file.
It was discovered that Libav incorrectly handled certain malformed media
files. If a user were tricked into opening a crafted media file, an
attacker could cause a denial of service via application crash, or possibly
execute arbitrary code with the privileges of the user invoking the
program.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2016-1897: ffmpeg - FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbi...
vendor_debian·2016·CVSS 5.5
CVE-2016-1897 [MEDIUM] CVE-2016-1897: ffmpeg - FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbi...
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
Scope: local
bookworm: resolved (fixed in 7:2.8.5-1)
bullseye: resolved (fixed in 7:2.8.5-1)
forky: resolved (fixed in 7:2.8.5-1)
sid: resolved (fixed in 7:2.8.5-1)
trixie: resolved (fixed in 7:2.8.5-1)
GHSA
GHSA-4p87-h585-c5xj: FFmpeg 2
ghsa_unreviewed·2022-05-14
CVE-2016-1897 [MEDIUM] CWE-200 GHSA-4p87-h585-c5xj: FFmpeg 2
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
OSV
CVE-2016-1897: FFmpeg 2
osv·2016-01-15·CVSS 5.5
CVE-2016-1897 [MEDIUM] CVE-2016-1897: FFmpeg 2
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://habrahabr.ru/company/mailru/blog/274855http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.htmlhttp://security.stackexchange.com/questions/110644http://www.debian.org/security/2016/dsa-3506http://www.openwall.com/lists/oss-security/2016/01/14/1http://www.securityfocus.com/bid/80501http://www.securitytracker.com/id/1034932http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.529036http://www.ubuntu.com/usn/USN-2944-1https://security.gentoo.org/glsa/201606-09https://security.gentoo.org/glsa/201705-08https://www.kb.cert.org/vuls/id/772447http://habrahabr.ru/company/mailru/blog/274855http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.htmlhttp://security.stackexchange.com/questions/110644http://www.debian.org/security/2016/dsa-3506http://www.openwall.com/lists/oss-security/2016/01/14/1http://www.securityfocus.com/bid/80501http://www.securitytracker.com/id/1034932http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.529036http://www.ubuntu.com/usn/USN-2944-1https://security.gentoo.org/glsa/201606-09https://security.gentoo.org/glsa/201705-08https://www.kb.cert.org/vuls/id/772447
2016-01-15
Published