CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS
Percentile
77.2%
ffmpeg is a βcross-platform solution to record, convert and stream audio and videoβ. ffmpeg is vulnerable to local file disclosure due to improper enforcement of domain restrictions when processing playlist files.
CWE-201**: Information Exposure Through Sent Data**** -CVE-2016-1897,**CVE-2016-1898
When a user opens a maliciously crafted playlist file in ffmpeg, ffmpeg will query a server for remote data. By carefully crafting the playlist, an attacker can cause ffmpeg to request internet URIs that expose file://
content from the victimβs machine. CVE-2016-1897 refers to an issue with processing playlists that use concatenations, while CVE-2016-1898 refers to a related issue with subfiles.
According to a mailing list post from MITREβs CVE team:
The essential problem is that a crafted file forces the victim to visit an arbitrary external URL, but this URL is constructed using data from the victimβs local filesystem.
More details are provided by the researcher in a blog post (in Russian).
Libav is a fork of ffmpeg and is also vulnerable.
By causing a specially-crafted playlist file to be processed with ffmpeg or Libav, a remote attacker may acquire file contents from a vulnerable system. In some circumstances, this may occur without explicit user interaction (such as the creation of a thumbnail preview by a file manager).
Apply an update
ffmpeg version 2.8.5 has been released to address this issue. Affected users are encouraged to update as soon as possible.
772447
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Updated: January 20, 2016
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: January 20, 2016 Updated: January 20, 2016
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: January 20, 2016 Updated: January 20, 2016
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: January 20, 2016 Updated: January 20, 2016
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Updated: January 20, 2016
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: January 20, 2016 Updated: January 20, 2016
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: January 20, 2016 Updated: January 20, 2016
Statement Date: January 20, 2016
Affected
We have not received a statement from the vendor.
Weβve sponsored updates for Ubuntu 15.04 (ffmpeg 7:2.5.10-0ubuntu0.15.04.1) and Ubuntu 15.10 (ffmpeg 7:2.7.5-0ubuntu0.15.10.1).
Updated: January 21, 2016
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Updated: January 20, 2016
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: January 20, 2016 Updated: January 21, 2016
Statement Date: January 21, 2016
Not Affected
We have not received a statement from the vendor.
Red Hat ships only qffmpeg, which is a stripped-down fork of ffmpeg that is not vulnerable.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23772447 Feedback>).
Notified: January 20, 2016 Updated: March 10, 2016
Statement Date: March 10, 2016
Not Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: January 20, 2016 Updated: January 20, 2016
Statement Date: January 20, 2016
Not Affected
We have not received a statement from the vendor.
Neither of these (ffmpeg or libav) are in OmniOS. They may be in unsupported 3rd-party packages, but they are not in OmniOS itself.
Notified: January 20, 2016 Updated: January 21, 2016
Statement Date: January 21, 2016
Not Affected
We have not received a statement from the vendor.
Red Hat ships only qffmpeg, which is a stripped-down fork of ffmpeg that is not vulnerable.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23772447 Feedback>).
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 21, 2016
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
Notified: January 20, 2016 Updated: January 20, 2016
Unknown
We have not received a statement from the vendor.
View all 40 vendors __View less vendors __
Group | Score | Vector |
---|---|---|
Base | 5 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Temporal | 3.9 | E:POC/RL:OF/RC:C |
Environmental | 2.9 | CDP:ND/TD:M/CR:ND/IR:ND/AR:ND |
This vulnerability was publicly disclosed by Maxim Andreev.
This document was written by Garret Wassermann and Will Dormann.
CVE IDs: | CVE-2016-1897, CVE-2016-1898 |
---|---|
Date Public: | 2016-01-12 Date First Published: |
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS
Percentile
77.2%