PT-2017-19326 · FFmpeg+1 · Ffmpeg+1

Emil Lerner + 2 · Published 2017-06-14 · Updated 2019-03-26 · CVE-2017-9993

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.8.12 FFmpeg versions 3.0.x and 3.1.x prior to 3.1.9 FFmpeg versions 3.2.x prior to 3.2.6 FFmpeg versions 3.3.x prior to 3.3.2

Description The issue allows attackers to read arbitrary files via crafted playlist data due to improper restriction of HTTP Live Streaming filename extensions and demuxer names.

Recommendations For FFmpeg versions prior to 2.8.12, update to version 2.8.12 or later. For FFmpeg versions 3.0.x and 3.1.x prior to 3.1.9, update to version 3.1.9 or later. For FFmpeg versions 3.2.x prior to 3.2.6, update to version 3.2.6 or later. For FFmpeg versions 3.3.x prior to 3.3.2, update to version 3.3.2 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2017-1725

ALT-PU-2017-1960

ALT-PU-2017-2226

ALT-PU-2017-2526

ALT-PU-2018-1929

ALT-PU-2018-2047

CVE-2017-9993

DLA-1630-1

DSA-3957-1

MGASA-2018-0008

Affected Products

Alt Linux

Ffmpeg

References · 102

• 🔥 https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2017-9993.md · Exploit
• https://github.com/FFmpeg/FFmpeg/commit/a5d849b149ca67ced2d271dc84db0bc95a548abb · Patch
• https://github.com/FFmpeg/FFmpeg/commit/189ff4219644532bdfa7bab28dfedaee4d6d4021 · Patch
• https://bdu.fstec.ru/vul/2017-02297 · Security Note
• https://security-tracker.debian.org/tracker/DLA-1630-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02090 · Security Note
• https://bdu.fstec.ru/vul/2017-02093 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14055 · Security Note
• http://debian.org/security/2017/dsa-3957 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6392 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-9993 · Security Note
• https://advisories.mageia.org/MGASA-2018-0008.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9841 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7751 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15186 · Security Note