PT-2017-19326 · FFmpeg+1 · Ffmpeg+1

Emil Lerner

+2

·

Publicado

2017-06-14

·

Atualizado

2019-03-26

·

CVE-2017-9993

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.8.12 FFmpeg versions 3.0.x and 3.1.x prior to 3.1.9 FFmpeg versions 3.2.x prior to 3.2.6 FFmpeg versions 3.3.x prior to 3.3.2
Description The issue allows attackers to read arbitrary files via crafted playlist data due to improper restriction of HTTP Live Streaming filename extensions and demuxer names.
Recommendations For FFmpeg versions prior to 2.8.12, update to version 2.8.12 or later. For FFmpeg versions 3.0.x and 3.1.x prior to 3.1.9, update to version 3.1.9 or later. For FFmpeg versions 3.2.x prior to 3.2.6, update to version 3.2.6 or later. For FFmpeg versions 3.3.x prior to 3.3.2, update to version 3.3.2 or later.

Exploit

Correção

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2017-1725
ALT-PU-2017-1960
ALT-PU-2017-2226
ALT-PU-2017-2526
ALT-PU-2018-1929
ALT-PU-2018-2047
CVE-2017-9993
DLA-1630-1
DSA-3957-1
MGASA-2018-0008

Produtos afetados

Alt Linux
Ffmpeg