FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
21 Nov 2024, 02:47
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://habrahabr.ru/company/mailru/blog/274855 - Exploit | |
| References | () http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.html - | |
| References | () http://security.stackexchange.com/questions/110644 - Exploit | |
| References | () http://www.debian.org/security/2016/dsa-3506 - | |
| References | () http://www.openwall.com/lists/oss-security/2016/01/14/1 - | |
| References | () http://www.securityfocus.com/bid/80501 - | |
| References | () http://www.securitytracker.com/id/1034932 - | |
| References | () http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.529036 - | |
| References | () http://www.ubuntu.com/usn/USN-2944-1 - | |
| References | () https://security.gentoo.org/glsa/201606-09 - | |
| References | () https://security.gentoo.org/glsa/201705-08 - | |
| References | () https://www.kb.cert.org/vuls/id/772447 - |
Information
Published : 2016-01-15 03:59
Updated : 2025-04-12 10:46
NVD link : CVE-2016-1897
Mitre link : CVE-2016-1897
CVE.ORG link : CVE-2016-1897
JSON object : View
Products Affected
canonical
- ubuntu_linux
opensuse
- leap
ffmpeg
- ffmpeg
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor