CVE-2016-1898
published 2016-01-15CVE-2016-1898: FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8…
PriorityP335medium5.5CVSS 3.0
AVLACLPRNUIRSUCHINAN
EPSS
13.02%
95.9th percentile
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.
Affected
88 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| debian | ffmpeg | < ffmpeg 7:2.8.5-1 (bookworm) | ffmpeg 7:2.8.5-1 (bookworm) |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
| ffmpeg | ffmpeg | — | — |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv5.5MEDIUM
vendor_debian5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Libav vulnerabilities
vendor_ubuntu·2016-04-04
CVE-2014-8541 Libav vulnerabilities
Title: Libav vulnerabilities
Summary: Libav could be made to crash or run programs as your login if it opened a
specially crafted file.
It was discovered that Libav incorrectly handled certain malformed media
files. If a user were tricked into opening a crafted media file, an
attacker could cause a denial of service via application crash, or possibly
execute arbitrary code with the privileges of the user invoking the
program.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2016-1898: ffmpeg - FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbi...
vendor_debian·2016·CVSS 5.5
CVE-2016-1898 [MEDIUM] CVE-2016-1898: ffmpeg - FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbi...
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.
Scope: local
bookworm: resolved (fixed in 7:2.8.5-1)
bullseye: resolved (fixed in 7:2.8.5-1)
forky: resolved (fixed in 7:2.8.5-1)
sid: resolved (fixed in 7:2.8.5-1)
trixie: resolved (fixed in 7:2.8.5-1)
GHSA
GHSA-2mw9-cpc8-cf9f: FFmpeg 2
ghsa_unreviewed·2022-05-14
CVE-2016-1898 [MEDIUM] CWE-200 GHSA-2mw9-cpc8-cf9f: FFmpeg 2
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.
OSV
CVE-2016-1898: FFmpeg 2
osv·2016-01-15·CVSS 5.5
CVE-2016-1898 [MEDIUM] CVE-2016-1898: FFmpeg 2
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.
No detection rules found.
No public exploits indexed.
http://habrahabr.ru/company/mailru/blog/274855http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.htmlhttp://www.debian.org/security/2016/dsa-3506http://www.openwall.com/lists/oss-security/2016/01/14/1http://www.securityfocus.com/bid/80501http://www.securitytracker.com/id/1034932http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.529036http://www.ubuntu.com/usn/USN-2944-1https://security.gentoo.org/glsa/201606-09https://security.gentoo.org/glsa/201705-08https://www.kb.cert.org/vuls/id/772447http://habrahabr.ru/company/mailru/blog/274855http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.htmlhttp://www.debian.org/security/2016/dsa-3506http://www.openwall.com/lists/oss-security/2016/01/14/1http://www.securityfocus.com/bid/80501http://www.securitytracker.com/id/1034932http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.529036http://www.ubuntu.com/usn/USN-2944-1https://security.gentoo.org/glsa/201606-09https://security.gentoo.org/glsa/201705-08https://www.kb.cert.org/vuls/id/772447
2016-01-15
Published