CVE-2016-1898: Infoleak

Published Jan 15, 2016

Updated

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.

Affected Software

84 affected components

FFmpeg FFmpeg=2.0

FFmpeg FFmpeg=2.0.1

FFmpeg FFmpeg=2.0.2

FFmpeg FFmpeg=2.0.3

FFmpeg FFmpeg=2.0.4

FFmpeg FFmpeg=2.0.5

FFmpeg FFmpeg=2.0.6

FFmpeg FFmpeg=2.0.7

FFmpeg FFmpeg=2.1

FFmpeg FFmpeg=2.1.1

FFmpeg FFmpeg=2.1.2

FFmpeg FFmpeg=2.1.3

FFmpeg FFmpeg=2.1.4

FFmpeg FFmpeg=2.1.5

FFmpeg FFmpeg=2.1.6

FFmpeg FFmpeg=2.1.7

FFmpeg FFmpeg=2.1.8

FFmpeg FFmpeg=2.2

FFmpeg FFmpeg=2.2.1

FFmpeg FFmpeg=2.2.2

FFmpeg FFmpeg=2.2.3

FFmpeg FFmpeg=2.2.4

FFmpeg FFmpeg=2.2.5

FFmpeg FFmpeg=2.2.6

FFmpeg FFmpeg=2.2.7

FFmpeg FFmpeg=2.2.8

FFmpeg FFmpeg=2.2.9

FFmpeg FFmpeg=2.2.10

FFmpeg FFmpeg=2.2.11

FFmpeg FFmpeg=2.2.12

FFmpeg FFmpeg=2.2.13

FFmpeg FFmpeg=2.2.14

FFmpeg FFmpeg=2.2.15

FFmpeg FFmpeg=2.2.16

FFmpeg FFmpeg=2.3

FFmpeg FFmpeg=2.3.1

FFmpeg FFmpeg=2.3.2

FFmpeg FFmpeg=2.3.3

FFmpeg FFmpeg=2.3.4

FFmpeg FFmpeg=2.3.5

FFmpeg FFmpeg=2.3.6

FFmpeg FFmpeg=2.4

FFmpeg FFmpeg=2.4.1

FFmpeg FFmpeg=2.4.2

FFmpeg FFmpeg=2.4.3

FFmpeg FFmpeg=2.4.4

FFmpeg FFmpeg=2.4.5

FFmpeg FFmpeg=2.4.6

FFmpeg FFmpeg=2.4.7

FFmpeg FFmpeg=2.4.8

FFmpeg FFmpeg=2.4.9

FFmpeg FFmpeg=2.4.10

FFmpeg FFmpeg=2.4.11

FFmpeg FFmpeg=2.4.12

FFmpeg FFmpeg=2.5

FFmpeg FFmpeg=2.5.1

FFmpeg FFmpeg=2.5.2

FFmpeg FFmpeg=2.5.3

FFmpeg FFmpeg=2.5.4

FFmpeg FFmpeg=2.5.5

FFmpeg FFmpeg=2.5.6

FFmpeg FFmpeg=2.5.7

FFmpeg FFmpeg=2.5.8

FFmpeg FFmpeg=2.5.9

FFmpeg FFmpeg=2.6

FFmpeg FFmpeg=2.6.1

FFmpeg FFmpeg=2.6.2

FFmpeg FFmpeg=2.6.3

FFmpeg FFmpeg=2.6.4

FFmpeg FFmpeg=2.6.5

FFmpeg FFmpeg=2.6.6

FFmpeg FFmpeg=2.7

FFmpeg FFmpeg=2.7.1

FFmpeg FFmpeg=2.7.2

FFmpeg FFmpeg=2.7.3

FFmpeg FFmpeg=2.7.4

FFmpeg FFmpeg=2.8

FFmpeg FFmpeg=2.8-dev

FFmpeg FFmpeg=2.8.1

FFmpeg FFmpeg=2.8.2

FFmpeg FFmpeg=2.8.3

FFmpeg FFmpeg=2.8.4

Canonical Ubuntu Linux=12.04

openSUSE Leap=42.1

Event History

Jan 15, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Data Sourced

via OSV·03:59 AM

DescriptionSeverity

Frequently Asked Questions

What is the severity of CVE-2016-1898?

CVE-2016-1898 is considered a moderate severity vulnerability due to its potential to allow remote attackers to read arbitrary files.

How do I fix CVE-2016-1898?

To fix CVE-2016-1898, upgrade to a version of FFmpeg that is released after version 2.8.4 where the vulnerability has been addressed.

What software is affected by CVE-2016-1898?

CVE-2016-1898 affects FFmpeg versions 2.0 to 2.8.4.

What type of vulnerability is CVE-2016-1898?

CVE-2016-1898 is a cross-origin vulnerability that allows attackers to perform unauthorized file access.

Can CVE-2016-1898 be exploited remotely?

Yes, CVE-2016-1898 can be exploited by remote attackers through specially crafted HLS M3U8 files.