CVE-2016-1897: Infoleak
Published Jan 15, 2016
·Updated
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
Affected Software
84 affected components
FFmpeg FFmpeg=2.0
FFmpeg FFmpeg=2.0.1
FFmpeg FFmpeg=2.0.2
FFmpeg FFmpeg=2.0.3
FFmpeg FFmpeg=2.0.4
FFmpeg FFmpeg=2.0.5
FFmpeg FFmpeg=2.0.6
FFmpeg FFmpeg=2.0.7
FFmpeg FFmpeg=2.1
FFmpeg FFmpeg=2.1.1
FFmpeg FFmpeg=2.1.2
FFmpeg FFmpeg=2.1.3
FFmpeg FFmpeg=2.1.4
FFmpeg FFmpeg=2.1.5
FFmpeg FFmpeg=2.1.6
FFmpeg FFmpeg=2.1.7
FFmpeg FFmpeg=2.1.8
FFmpeg FFmpeg=2.2
FFmpeg FFmpeg=2.2.1
FFmpeg FFmpeg=2.2.2
FFmpeg FFmpeg=2.2.3
FFmpeg FFmpeg=2.2.4
FFmpeg FFmpeg=2.2.5
FFmpeg FFmpeg=2.2.6
FFmpeg FFmpeg=2.2.7
FFmpeg FFmpeg=2.2.8
FFmpeg FFmpeg=2.2.9
FFmpeg FFmpeg=2.2.10
FFmpeg FFmpeg=2.2.11
FFmpeg FFmpeg=2.2.12
FFmpeg FFmpeg=2.2.13
FFmpeg FFmpeg=2.2.14
FFmpeg FFmpeg=2.2.15
FFmpeg FFmpeg=2.2.16
FFmpeg FFmpeg=2.3
FFmpeg FFmpeg=2.3.1
FFmpeg FFmpeg=2.3.2
FFmpeg FFmpeg=2.3.3
FFmpeg FFmpeg=2.3.4
FFmpeg FFmpeg=2.3.5
FFmpeg FFmpeg=2.3.6
FFmpeg FFmpeg=2.4
FFmpeg FFmpeg=2.4.1
FFmpeg FFmpeg=2.4.2
FFmpeg FFmpeg=2.4.3
FFmpeg FFmpeg=2.4.4
FFmpeg FFmpeg=2.4.5
FFmpeg FFmpeg=2.4.6
FFmpeg FFmpeg=2.4.7
FFmpeg FFmpeg=2.4.8
FFmpeg FFmpeg=2.4.9
FFmpeg FFmpeg=2.4.10
FFmpeg FFmpeg=2.4.11
FFmpeg FFmpeg=2.4.12
FFmpeg FFmpeg=2.5
FFmpeg FFmpeg=2.5.1
FFmpeg FFmpeg=2.5.2
FFmpeg FFmpeg=2.5.3
FFmpeg FFmpeg=2.5.4
FFmpeg FFmpeg=2.5.5
FFmpeg FFmpeg=2.5.6
FFmpeg FFmpeg=2.5.7
FFmpeg FFmpeg=2.5.8
FFmpeg FFmpeg=2.5.9
FFmpeg FFmpeg=2.6
FFmpeg FFmpeg=2.6.1
FFmpeg FFmpeg=2.6.2
FFmpeg FFmpeg=2.6.3
FFmpeg FFmpeg=2.6.4
FFmpeg FFmpeg=2.6.5
FFmpeg FFmpeg=2.6.6
FFmpeg FFmpeg=2.7
FFmpeg FFmpeg=2.7.1
FFmpeg FFmpeg=2.7.2
FFmpeg FFmpeg=2.7.3
FFmpeg FFmpeg=2.7.4
FFmpeg FFmpeg=2.8
FFmpeg FFmpeg=2.8-dev
FFmpeg FFmpeg=2.8.1
FFmpeg FFmpeg=2.8.2
FFmpeg FFmpeg=2.8.3
FFmpeg FFmpeg=2.8.4
Canonical Ubuntu Linux=12.04
openSUSE Leap=42.1
Event History
Jan 15, 2016
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Data Sourced
via OSV·03:59 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2016-1897?
CVE-2016-1897 is classified as a medium-severity vulnerability.
2
How do I fix CVE-2016-1897?
To fix CVE-2016-1897, upgrade FFmpeg to version 2.8 or later.
3
What are the impacts of CVE-2016-1897?
CVE-2016-1897 allows remote attackers to conduct cross-origin attacks and read arbitrary files.
4
Which versions of FFmpeg are affected by CVE-2016-1897?
FFmpeg versions 2.0 through 2.7 are affected by CVE-2016-1897.
5
Is there a workaround for CVE-2016-1897?
A possible workaround for CVE-2016-1897 is to disable the concat protocol in FFmpeg.