CVE-2017-9993
High · 7.5CVSS
7.5
EPSS
16.4%
Published
Jun 28, 2017
CISA due date
—
The record
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Alpine:v3.4 | ffmpeg | 0 | 3.1.9-r0 |
| Alpine:v3.5 | ffmpeg | 0 | 3.1.9-r0 |
| Alpine:v3.6 | ffmpeg | 0 | 3.2.6-r0 |
| Debian:11 | ffmpeg | 0 | 7:3.2.6-1 |
| Debian:12 | ffmpeg | 0 | 7:3.2.6-1 |
| Debian:13 | ffmpeg | 0 | 7:3.2.6-1 |
| Debian:8 | libav | 0 | 6:11.12-1~deb8u4 |
| Debian:9 | ffmpeg | 0 | 7:3.2.7-1~deb9u1 |
| Mageia:5 | ffmpeg | 0 | 2.4.14-1.mga5 |
| Mageia:5 | ffmpeg | 0 | 2.4.14-1.mga5.tainted |
| Ubuntu:16.04:LTS | ffmpeg | 0 | 7:2.8.14-0ubuntu0.16.04.1 |
| Ubuntu:Pro:14.04:LTS | libav | 0 | No fix |
Related vulnerabilities
- CVE-2025-0518 Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive… Also affects ffmpeg
- CVE-2023-6601 A flaw was found in FFmpeg's HLS demuxer. Also affects ffmpeg
- CVE-2023-6604 A flaw was found in FFmpeg. Also affects ffmpeg
- CVE-2023-6605 A flaw was found in FFmpeg's DASH playlist support. Also affects ffmpeg
- CVE-2024-36613 FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing… Also affects ffmpeg
- CVE-2023-6603 A flaw was found in FFmpeg's HLS playlist parsing. Also affects ffmpeg
- CVE-2023-6602 A flaw was found in FFmpeg's TTY Demuxer. Also affects ffmpeg
- CVE-2024-35368 FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within… Also affects ffmpeg