p PatchFirst

CVE-2016-1898

CVE-2016-1898

This page contains facts from public vulnerability sources. Check the original advisory before updating.

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.

CVSS 5.5 · Medium · EPSS 13.0% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • ffmpeg Debian:12

    Affected ranges
    • ECOSYSTEM: < 7:2.8.5-1

    Update to 7:2.8.5-1

  • ffmpeg Debian:13

    Affected ranges
    • ECOSYSTEM: < 7:2.8.5-1

    Update to 7:2.8.5-1

  • ffmpeg Debian:14

    Affected ranges
    • ECOSYSTEM: < 7:2.8.5-1

    Update to 7:2.8.5-1

  • libav Ubuntu:Pro:14.04:LTS

    Versions
    • 6:0.8.7-1ubuntu2
    • 6:9.10-1ubuntu1
    • 6:9.10-1ubuntu2
    • 6:9.10-1ubuntu5
    • 6:9.10-1ubuntu6
    • 6:9.10-1ubuntu7
    • 6:9.11-2ubuntu1
    • 6:9.11-2ubuntu2
    • 6:9.13-0ubuntu0.14.04.1
    • 6:9.14-0ubuntu0.14.04.1
    • 6:9.16-0ubuntu0.14.04.1
    • 6:9.18-0ubuntu0.14.04.1
    • 6:9.20-0ubuntu0.14.04.1
    Affected ranges
    • ECOSYSTEM: < 6:9.20-0ubuntu0.14.04.1+esm1

    Update to 6:9.20-0ubuntu0.14.04.1+esm1

  • ffmpeg Ubuntu:16.04:LTS

    Versions
    • 7:2.7.2-1build1
    • 7:2.8.1-1ubuntu1
    • 7:2.8.2-1ubuntu1
    • 7:2.8.3-1
    • 7:2.8.4-1
    • 7:2.8.4-1ubuntu1
    • 7:2.8.4-1ubuntu2
    • 7:2.8.4-1ubuntu3
    • 7:2.8.4-1ubuntu4
    Affected ranges
    • ECOSYSTEM: < 7:2.8.6-1ubuntu1

    Update to 7:2.8.6-1ubuntu1

Original sources

Check your server →