CVE-2016-1897: Infoleak
First published: Fri Jan 15 2016(Updated: )
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FFmpeg | =2.0 | |
| FFmpeg | =2.0.1 | |
| FFmpeg | =2.0.2 | |
| FFmpeg | =2.0.3 | |
| FFmpeg | =2.0.4 | |
| FFmpeg | =2.0.5 | |
| FFmpeg | =2.0.6 | |
| FFmpeg | =2.0.7 | |
| FFmpeg | =2.1 | |
| FFmpeg | =2.1.1 | |
| FFmpeg | =2.1.2 | |
| FFmpeg | =2.1.3 | |
| FFmpeg | =2.1.4 | |
| FFmpeg | =2.1.5 | |
| FFmpeg | =2.1.6 | |
| FFmpeg | =2.1.7 | |
| FFmpeg | =2.1.8 | |
| FFmpeg | =2.2 | |
| FFmpeg | =2.2.1 | |
| FFmpeg | =2.2.2 | |
| FFmpeg | =2.2.3 | |
| FFmpeg | =2.2.4 | |
| FFmpeg | =2.2.5 | |
| FFmpeg | =2.2.6 | |
| FFmpeg | =2.2.7 | |
| FFmpeg | =2.2.8 | |
| FFmpeg | =2.2.9 | |
| FFmpeg | =2.2.10 | |
| FFmpeg | =2.2.11 | |
| FFmpeg | =2.2.12 | |
| FFmpeg | =2.2.13 | |
| FFmpeg | =2.2.14 | |
| FFmpeg | =2.2.15 | |
| FFmpeg | =2.2.16 | |
| FFmpeg | =2.3 | |
| FFmpeg | =2.3.1 | |
| FFmpeg | =2.3.2 | |
| FFmpeg | =2.3.3 | |
| FFmpeg | =2.3.4 | |
| FFmpeg | =2.3.5 | |
| FFmpeg | =2.3.6 | |
| FFmpeg | =2.4 | |
| FFmpeg | =2.4.1 | |
| FFmpeg | =2.4.2 | |
| FFmpeg | =2.4.3 | |
| FFmpeg | =2.4.4 | |
| FFmpeg | =2.4.5 | |
| FFmpeg | =2.4.6 | |
| FFmpeg | =2.4.7 | |
| FFmpeg | =2.4.8 | |
| FFmpeg | =2.4.9 | |
| FFmpeg | =2.4.10 | |
| FFmpeg | =2.4.11 | |
| FFmpeg | =2.4.12 | |
| FFmpeg | =2.5 | |
| FFmpeg | =2.5.1 | |
| FFmpeg | =2.5.2 | |
| FFmpeg | =2.5.3 | |
| FFmpeg | =2.5.4 | |
| FFmpeg | =2.5.5 | |
| FFmpeg | =2.5.6 | |
| FFmpeg | =2.5.7 | |
| FFmpeg | =2.5.8 | |
| FFmpeg | =2.5.9 | |
| FFmpeg | =2.6 | |
| FFmpeg | =2.6.1 | |
| FFmpeg | =2.6.2 | |
| FFmpeg | =2.6.3 | |
| FFmpeg | =2.6.4 | |
| FFmpeg | =2.6.5 | |
| FFmpeg | =2.6.6 | |
| FFmpeg | =2.7 | |
| FFmpeg | =2.7.1 | |
| FFmpeg | =2.7.2 | |
| FFmpeg | =2.7.3 | |
| FFmpeg | =2.7.4 | |
| FFmpeg | =2.8 | |
| FFmpeg | =2.8-dev | |
| FFmpeg | =2.8.1 | |
| FFmpeg | =2.8.2 | |
| FFmpeg | =2.8.3 | |
| FFmpeg | =2.8.4 | |
| Ubuntu | =12.04 | |
| openSUSE | =42.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://habrahabr.ru/company/mailru/blog/274855
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.html
- http://security.stackexchange.com/questions/110644
- http://www.debian.org/security/2016/dsa-3506
- http://www.openwall.com/lists/oss-security/2016/01/14/1
- http://www.securityfocus.com/bid/80501
- http://www.securitytracker.com/id/1034932
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.529036
- http://www.ubuntu.com/usn/USN-2944-1
- https://security.gentoo.org/glsa/201606-09
- https://security.gentoo.org/glsa/201705-08
- https://www.kb.cert.org/vuls/id/772447
Frequently Asked Questions
What is the severity of CVE-2016-1897?
CVE-2016-1897 is classified as a medium-severity vulnerability.
How do I fix CVE-2016-1897?
To fix CVE-2016-1897, upgrade FFmpeg to version 2.8 or later.
What are the impacts of CVE-2016-1897?
CVE-2016-1897 allows remote attackers to conduct cross-origin attacks and read arbitrary files.
Which versions of FFmpeg are affected by CVE-2016-1897?
FFmpeg versions 2.0 through 2.7 are affected by CVE-2016-1897.
Is there a workaround for CVE-2016-1897?
A possible workaround for CVE-2016-1897 is to disable the concat protocol in FFmpeg.
- agent/type
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ffmpeg
- canonical/ffmpeg
- version/ffmpeg/2.0
- version/ffmpeg/2.0.1
- version/ffmpeg/2.0.2
- version/ffmpeg/2.0.3
- version/ffmpeg/2.0.4
- version/ffmpeg/2.0.5
- version/ffmpeg/2.0.6
- version/ffmpeg/2.0.7
- version/ffmpeg/2.1
- version/ffmpeg/2.1.1
- version/ffmpeg/2.1.2
- version/ffmpeg/2.1.3
- version/ffmpeg/2.1.4
- version/ffmpeg/2.1.5
- version/ffmpeg/2.1.6
- version/ffmpeg/2.1.7
- version/ffmpeg/2.1.8
- version/ffmpeg/2.2
- version/ffmpeg/2.2.1
- version/ffmpeg/2.2.2
- version/ffmpeg/2.2.3
- version/ffmpeg/2.2.4
- version/ffmpeg/2.2.5
- version/ffmpeg/2.2.6
- version/ffmpeg/2.2.7
- version/ffmpeg/2.2.8
- version/ffmpeg/2.2.9
- version/ffmpeg/2.2.10
- version/ffmpeg/2.2.11
- version/ffmpeg/2.2.12
- version/ffmpeg/2.2.13
- version/ffmpeg/2.2.14
- version/ffmpeg/2.2.15
- version/ffmpeg/2.2.16
- version/ffmpeg/2.3
- version/ffmpeg/2.3.1
- version/ffmpeg/2.3.2
- version/ffmpeg/2.3.3
- version/ffmpeg/2.3.4
- version/ffmpeg/2.3.5
- version/ffmpeg/2.3.6
- version/ffmpeg/2.4
- version/ffmpeg/2.4.1
- version/ffmpeg/2.4.2
- version/ffmpeg/2.4.3
- version/ffmpeg/2.4.4
- version/ffmpeg/2.4.5
- version/ffmpeg/2.4.6
- version/ffmpeg/2.4.7
- version/ffmpeg/2.4.8
- version/ffmpeg/2.4.9
- version/ffmpeg/2.4.10
- version/ffmpeg/2.4.11
- version/ffmpeg/2.4.12
- version/ffmpeg/2.5
- version/ffmpeg/2.5.1
- version/ffmpeg/2.5.2
- version/ffmpeg/2.5.3
- version/ffmpeg/2.5.4
- version/ffmpeg/2.5.5
- version/ffmpeg/2.5.6
- version/ffmpeg/2.5.7
- version/ffmpeg/2.5.8
- version/ffmpeg/2.5.9
- version/ffmpeg/2.6
- version/ffmpeg/2.6.1
- version/ffmpeg/2.6.2
- version/ffmpeg/2.6.3
- version/ffmpeg/2.6.4
- version/ffmpeg/2.6.5
- version/ffmpeg/2.6.6
- version/ffmpeg/2.7
- version/ffmpeg/2.7.1
- version/ffmpeg/2.7.2
- version/ffmpeg/2.7.3
- version/ffmpeg/2.7.4
- version/ffmpeg/2.8
- version/ffmpeg/2.8-dev
- version/ffmpeg/2.8.1
- version/ffmpeg/2.8.2
- version/ffmpeg/2.8.3
- version/ffmpeg/2.8.4
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/12.04
- vendor/opensuse
- canonical/opensuse
- version/opensuse/42.1