CVE-2016-1897: Infoleak
First published: Fri Jan 15 2016(Updated: )
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FFmpeg FFmpeg | =2.0 | |
| FFmpeg FFmpeg | =2.0.1 | |
| FFmpeg FFmpeg | =2.0.2 | |
| FFmpeg FFmpeg | =2.0.3 | |
| FFmpeg FFmpeg | =2.0.4 | |
| FFmpeg FFmpeg | =2.0.5 | |
| FFmpeg FFmpeg | =2.0.6 | |
| FFmpeg FFmpeg | =2.0.7 | |
| FFmpeg FFmpeg | =2.1 | |
| FFmpeg FFmpeg | =2.1.1 | |
| FFmpeg FFmpeg | =2.1.2 | |
| FFmpeg FFmpeg | =2.1.3 | |
| FFmpeg FFmpeg | =2.1.4 | |
| FFmpeg FFmpeg | =2.1.5 | |
| FFmpeg FFmpeg | =2.1.6 | |
| FFmpeg FFmpeg | =2.1.7 | |
| FFmpeg FFmpeg | =2.1.8 | |
| FFmpeg FFmpeg | =2.2 | |
| FFmpeg FFmpeg | =2.2.1 | |
| FFmpeg FFmpeg | =2.2.2 | |
| FFmpeg FFmpeg | =2.2.3 | |
| FFmpeg FFmpeg | =2.2.4 | |
| FFmpeg FFmpeg | =2.2.5 | |
| FFmpeg FFmpeg | =2.2.6 | |
| FFmpeg FFmpeg | =2.2.7 | |
| FFmpeg FFmpeg | =2.2.8 | |
| FFmpeg FFmpeg | =2.2.9 | |
| FFmpeg FFmpeg | =2.2.10 | |
| FFmpeg FFmpeg | =2.2.11 | |
| FFmpeg FFmpeg | =2.2.12 | |
| FFmpeg FFmpeg | =2.2.13 | |
| FFmpeg FFmpeg | =2.2.14 | |
| FFmpeg FFmpeg | =2.2.15 | |
| FFmpeg FFmpeg | =2.2.16 | |
| FFmpeg FFmpeg | =2.3 | |
| FFmpeg FFmpeg | =2.3.1 | |
| FFmpeg FFmpeg | =2.3.2 | |
| FFmpeg FFmpeg | =2.3.3 | |
| FFmpeg FFmpeg | =2.3.4 | |
| FFmpeg FFmpeg | =2.3.5 | |
| FFmpeg FFmpeg | =2.3.6 | |
| FFmpeg FFmpeg | =2.4 | |
| FFmpeg FFmpeg | =2.4.1 | |
| FFmpeg FFmpeg | =2.4.2 | |
| FFmpeg FFmpeg | =2.4.3 | |
| FFmpeg FFmpeg | =2.4.4 | |
| FFmpeg FFmpeg | =2.4.5 | |
| FFmpeg FFmpeg | =2.4.6 | |
| FFmpeg FFmpeg | =2.4.7 | |
| FFmpeg FFmpeg | =2.4.8 | |
| FFmpeg FFmpeg | =2.4.9 | |
| FFmpeg FFmpeg | =2.4.10 | |
| FFmpeg FFmpeg | =2.4.11 | |
| FFmpeg FFmpeg | =2.4.12 | |
| FFmpeg FFmpeg | =2.5 | |
| FFmpeg FFmpeg | =2.5.1 | |
| FFmpeg FFmpeg | =2.5.2 | |
| FFmpeg FFmpeg | =2.5.3 | |
| FFmpeg FFmpeg | =2.5.4 | |
| FFmpeg FFmpeg | =2.5.5 | |
| FFmpeg FFmpeg | =2.5.6 | |
| FFmpeg FFmpeg | =2.5.7 | |
| FFmpeg FFmpeg | =2.5.8 | |
| FFmpeg FFmpeg | =2.5.9 | |
| FFmpeg FFmpeg | =2.6 | |
| FFmpeg FFmpeg | =2.6.1 | |
| FFmpeg FFmpeg | =2.6.2 | |
| FFmpeg FFmpeg | =2.6.3 | |
| FFmpeg FFmpeg | =2.6.4 | |
| FFmpeg FFmpeg | =2.6.5 | |
| FFmpeg FFmpeg | =2.6.6 | |
| FFmpeg FFmpeg | =2.7 | |
| FFmpeg FFmpeg | =2.7.1 | |
| FFmpeg FFmpeg | =2.7.2 | |
| FFmpeg FFmpeg | =2.7.3 | |
| FFmpeg FFmpeg | =2.7.4 | |
| FFmpeg FFmpeg | =2.8 | |
| FFmpeg FFmpeg | =2.8-dev | |
| FFmpeg FFmpeg | =2.8.1 | |
| FFmpeg FFmpeg | =2.8.2 | |
| FFmpeg FFmpeg | =2.8.3 | |
| FFmpeg FFmpeg | =2.8.4 | |
| Canonical Ubuntu Linux | =12.04 | |
| openSUSE Leap | =42.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://habrahabr.ru/company/mailru/blog/274855
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.html
- http://security.stackexchange.com/questions/110644
- http://www.debian.org/security/2016/dsa-3506
- http://www.openwall.com/lists/oss-security/2016/01/14/1
- http://www.securityfocus.com/bid/80501
- http://www.securitytracker.com/id/1034932
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.529036
- http://www.ubuntu.com/usn/USN-2944-1
- https://security.gentoo.org/glsa/201606-09
- https://security.gentoo.org/glsa/201705-08
- https://www.kb.cert.org/vuls/id/772447
- agent/type
- agent/references
- agent/last-modified-date
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/weakness
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- vendor/ffmpeg
- canonical/ffmpeg ffmpeg
- version/ffmpeg ffmpeg/2.0
- version/ffmpeg ffmpeg/2.0.1
- version/ffmpeg ffmpeg/2.0.2
- version/ffmpeg ffmpeg/2.0.3
- version/ffmpeg ffmpeg/2.0.4
- version/ffmpeg ffmpeg/2.0.5
- version/ffmpeg ffmpeg/2.0.6
- version/ffmpeg ffmpeg/2.0.7
- version/ffmpeg ffmpeg/2.1
- version/ffmpeg ffmpeg/2.1.1
- version/ffmpeg ffmpeg/2.1.2
- version/ffmpeg ffmpeg/2.1.3
- version/ffmpeg ffmpeg/2.1.4
- version/ffmpeg ffmpeg/2.1.5
- version/ffmpeg ffmpeg/2.1.6
- version/ffmpeg ffmpeg/2.1.7
- version/ffmpeg ffmpeg/2.1.8
- version/ffmpeg ffmpeg/2.2
- version/ffmpeg ffmpeg/2.2.1
- version/ffmpeg ffmpeg/2.2.2
- version/ffmpeg ffmpeg/2.2.3
- version/ffmpeg ffmpeg/2.2.4
- version/ffmpeg ffmpeg/2.2.5
- version/ffmpeg ffmpeg/2.2.6
- version/ffmpeg ffmpeg/2.2.7
- version/ffmpeg ffmpeg/2.2.8
- version/ffmpeg ffmpeg/2.2.9
- version/ffmpeg ffmpeg/2.2.10
- version/ffmpeg ffmpeg/2.2.11
- version/ffmpeg ffmpeg/2.2.12
- version/ffmpeg ffmpeg/2.2.13
- version/ffmpeg ffmpeg/2.2.14
- version/ffmpeg ffmpeg/2.2.15
- version/ffmpeg ffmpeg/2.2.16
- version/ffmpeg ffmpeg/2.3
- version/ffmpeg ffmpeg/2.3.1
- version/ffmpeg ffmpeg/2.3.2
- version/ffmpeg ffmpeg/2.3.3
- version/ffmpeg ffmpeg/2.3.4
- version/ffmpeg ffmpeg/2.3.5
- version/ffmpeg ffmpeg/2.3.6
- version/ffmpeg ffmpeg/2.4
- version/ffmpeg ffmpeg/2.4.1
- version/ffmpeg ffmpeg/2.4.2
- version/ffmpeg ffmpeg/2.4.3
- version/ffmpeg ffmpeg/2.4.4
- version/ffmpeg ffmpeg/2.4.5
- version/ffmpeg ffmpeg/2.4.6
- version/ffmpeg ffmpeg/2.4.7
- version/ffmpeg ffmpeg/2.4.8
- version/ffmpeg ffmpeg/2.4.9
- version/ffmpeg ffmpeg/2.4.10
- version/ffmpeg ffmpeg/2.4.11
- version/ffmpeg ffmpeg/2.4.12
- version/ffmpeg ffmpeg/2.5
- version/ffmpeg ffmpeg/2.5.1
- version/ffmpeg ffmpeg/2.5.2
- version/ffmpeg ffmpeg/2.5.3
- version/ffmpeg ffmpeg/2.5.4
- version/ffmpeg ffmpeg/2.5.5
- version/ffmpeg ffmpeg/2.5.6
- version/ffmpeg ffmpeg/2.5.7
- version/ffmpeg ffmpeg/2.5.8
- version/ffmpeg ffmpeg/2.5.9
- version/ffmpeg ffmpeg/2.6
- version/ffmpeg ffmpeg/2.6.1
- version/ffmpeg ffmpeg/2.6.2
- version/ffmpeg ffmpeg/2.6.3
- version/ffmpeg ffmpeg/2.6.4
- version/ffmpeg ffmpeg/2.6.5
- version/ffmpeg ffmpeg/2.6.6
- version/ffmpeg ffmpeg/2.7
- version/ffmpeg ffmpeg/2.7.1
- version/ffmpeg ffmpeg/2.7.2
- version/ffmpeg ffmpeg/2.7.3
- version/ffmpeg ffmpeg/2.7.4
- version/ffmpeg ffmpeg/2.8
- version/ffmpeg ffmpeg/2.8-dev
- version/ffmpeg ffmpeg/2.8.1
- version/ffmpeg ffmpeg/2.8.2
- version/ffmpeg ffmpeg/2.8.3
- version/ffmpeg ffmpeg/2.8.4
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/12.04
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/42.1