Description (CNA)
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://github.com/FFmpeg/FFmpeg/commit/a5d849b149ca67ced2d271dc84db0bc95a548abb
- http://www.debian.org/security/2017/dsa-3957
- https://github.com/FFmpeg/FFmpeg/commit/189ff4219644532bdfa7bab28dfedaee4d6d4021
- http://www.securityfocus.com/bid/99315
- https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html
ADP enrichment
No English description supplied.
- https://github.com/FFmpeg/FFmpeg/commit/a5d849b149ca67ced2d271dc84db0bc95a548abb
- http://www.debian.org/security/2017/dsa-3957
- https://github.com/FFmpeg/FFmpeg/commit/189ff4219644532bdfa7bab28dfedaee4d6d4021
- http://www.securityfocus.com/bid/99315
- https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html