FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
21 Nov 2024, 02:47
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://habrahabr.ru/company/mailru/blog/274855 - Exploit | |
| References | () http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.html - | |
| References | () http://www.debian.org/security/2016/dsa-3506 - | |
| References | () http://www.openwall.com/lists/oss-security/2016/01/14/1 - | |
| References | () http://www.securityfocus.com/bid/80501 - | |
| References | () http://www.securitytracker.com/id/1034932 - | |
| References | () http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.529036 - | |
| References | () http://www.ubuntu.com/usn/USN-2944-1 - | |
| References | () https://security.gentoo.org/glsa/201606-09 - | |
| References | () https://security.gentoo.org/glsa/201705-08 - | |
| References | () https://www.kb.cert.org/vuls/id/772447 - |
Information
Published : 2016-01-15 03:59
Updated : 2024-11-21 02:47
NVD link : CVE-2016-1898
Mitre link : CVE-2016-1898
CVE.ORG link : CVE-2016-1898
JSON object : View
Products Affected
opensuse
- leap
canonical
- ubuntu_linux
ffmpeg
- ffmpeg
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor