CVE-2017-9993

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename…

published June 28, 2017

CVSS
—
EPSS
16%
Percentile
97.0
In the wild
Unconfirmed
What it is

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.16437 · 97.0th percentile
Published
2017-06-28T06:00Z
EPSS history
Timeline
  • 28 JUN 06:00Z
    FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename…
    cvelistv5