CVE-2016-1897 | BDVDB-2026-73853 Detail
Description#
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://security.stackexchange.com/questions/110644
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.html
- http://www.securitytracker.com/id/1034932
- https://security.gentoo.org/glsa/201705-08
- http://www.securityfocus.com/bid/80501
- http://www.ubuntu.com/usn/USN-2944-1
- http://www.openwall.com/lists/oss-security/2016/01/14/1
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.529036
- http://www.debian.org/security/2016/dsa-3506
- http://habrahabr.ru/company/mailru/blog/274855
- https://security.gentoo.org/glsa/201606-09
- https://www.kb.cert.org/vuls/id/772447
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.