CVE-2016-1897
Medium · 5.5CVSS
5.5
EPSS
14.6%
Published
Jan 15, 2016
CISA due date
—
The record
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | ffmpeg | 0 | 7:2.8.5-1 |
| Debian:12 | ffmpeg | 0 | 7:2.8.5-1 |
| Debian:13 | ffmpeg | 0 | 7:2.8.5-1 |
| Debian:7 | libav | 0 | 6:0.8.17-2 |
| Debian:8 | libav | 0 | 6:11.6-1~deb8u1 |
| Mageia:5 | ffmpeg | 0 | 2.4.13-1.mga5 |
| Mageia:5 | ffmpeg | 0 | 2.4.13-1.mga5.tainted |
| Ubuntu:16.04:LTS | ffmpeg | 0 | 7:2.8.6-1ubuntu1 |
| Ubuntu:Pro:14.04:LTS | libav | 0 | 6:9.20-0ubuntu0.14.04.1+esm1 |
| openSUSE:Tumbleweed | ffmpeg-4 | 0 | 4.4-5.2 |
Related vulnerabilities
- CVE-2025-0518 Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive… Also affects ffmpeg
- CVE-2023-6601 A flaw was found in FFmpeg's HLS demuxer. Also affects ffmpeg
- CVE-2023-6604 A flaw was found in FFmpeg. Also affects ffmpeg
- CVE-2023-6605 A flaw was found in FFmpeg's DASH playlist support. Also affects ffmpeg
- CVE-2024-36613 FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing… Also affects ffmpeg
- CVE-2023-6603 A flaw was found in FFmpeg's HLS playlist parsing. Also affects ffmpeg
- CVE-2023-6602 A flaw was found in FFmpeg's TTY Demuxer. Also affects ffmpeg
- CVE-2024-35368 FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within… Also affects ffmpeg