CVE-2017-9993: Infoleak
First published: Wed Jun 28 2017(Updated: )
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/ffmpeg | 7:4.1.9-0+deb10u1 7:4.1.11-0+deb10u1 7:4.3.6-0+deb11u1 7:5.1.3-1 7:6.0-7 | |
| FFmpeg | <2.8.12 | |
| FFmpeg | >=3.0<3.1.9 | |
| FFmpeg | >=3.2<3.2.6 | |
| FFmpeg | >=3.3<3.3.2 | |
| Debian GNU/Linux | =8.0 | |
| Debian GNU/Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/FFmpeg/FFmpeg/commit/189ff4219644532bdfa7bab28dfedaee4d6d4021
- https://github.com/FFmpeg/FFmpeg/commit/a5d849b149ca67ced2d271dc84db0bc95a548abb
- https://security-tracker.debian.org/tracker/CVE-2017-9993
- http://www.debian.org/security/2017/dsa-3957
- http://www.securityfocus.com/bid/99315
- https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html
Frequently Asked Questions
What is the severity of CVE-2017-9993?
CVE-2017-9993 is considered a high severity vulnerability due to its potential to allow unauthorized file access.
How do I fix CVE-2017-9993?
To mitigate CVE-2017-9993, update FFmpeg to versions 2.8.12, 3.1.9, 3.2.6, or 3.3.2 and later.
Which versions of FFmpeg are affected by CVE-2017-9993?
FFmpeg versions before 2.8.12, 3.0.x, 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 are affected by CVE-2017-9993.
What type of attack is possible with CVE-2017-9993?
CVE-2017-9993 allows attackers to read arbitrary files through crafted HTTP Live Streaming playlist data.
Can CVE-2017-9993 affect Debian users?
Yes, CVE-2017-9993 affects Debian users running vulnerable versions of FFmpeg.
- collector/security-tracker-debian
- agent/type
- agent/remedy
- agent/references
- agent/author
- agent/severity
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/ffmpeg
- canonical/ffmpeg
- version/ffmpeg/3.0
- version/ffmpeg/3.2
- version/ffmpeg/3.3
- vendor/debian
- canonical/debian gnu/linux
- version/debian gnu/linux/8.0
- version/debian gnu/linux/9.0