CVE-2017-9993

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.

CVSS v3.0

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

16.44% chance of exploitation in the next 30 days, 97th percentile

Published

2017-06-28

Updated

2024-08-05

Vulhub environments (1)

• vulhub/vulhub/tree/master/ffmpeg/CVE-2017-9993

References

• CVE Record
• NVD entry

Related

• CVE-2017-9989
• CVE-2017-9998
• CVE-2017-9988
• CVE-2017-9987
• CVE-2017-9979
• CVE-2017-9978