CVE-2017-9993 : FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.

Published 2017-06-28 06:29:01

Updated 2019-03-26 17:56:24

Source MITRE

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2017-9993

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Ffmpeg » Ffmpeg
Versions from including (>=) 3.3 and before (<) 3.3.2
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Matching versions
Ffmpeg » Ffmpeg
Versions before (<) 2.8.12
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Matching versions
Ffmpeg » Ffmpeg
Versions from including (>=) 3.2 and before (<) 3.2.6
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Matching versions
Ffmpeg » Ffmpeg
Versions from including (>=) 3.0 and before (<) 3.1.9
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2017-9993

EPSS FAQ

0.22%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 60 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-9993

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2017-9993

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-9993

https://github.com/FFmpeg/FFmpeg/commit/a5d849b149ca67ced2d271dc84db0bc95a548abb

avformat/avidec: Limit formats in gab2 to srt and ass/ssa · FFmpeg/FFmpeg@a5d849b · GitHub
Issue Tracking;Patch;Third Party Advisory
http://www.securityfocus.com/bid/99315

FFmpeg CVE-2017-9993 Arbitrary File Read Vulnerability
Third Party Advisory;VDB Entry
https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html

[SECURITY] [DLA 1630-1] libav security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.debian.org/security/2017/dsa-3957

Debian -- Security Information -- DSA-3957-1 ffmpeg
Third Party Advisory

CVEs referencing this url
https://github.com/FFmpeg/FFmpeg/commit/189ff4219644532bdfa7bab28dfedaee4d6d4021

avformat/hls: Check local file extensions · FFmpeg/FFmpeg@189ff42 · GitHub
Issue Tracking;Patch;Third Party Advisory

Jump to

Vulnerability Details : CVE-2017-9993

Products affected by CVE-2017-9993

Exploit prediction scoring system (EPSS) score for CVE-2017-9993

CVSS scores for CVE-2017-9993

CWE ids for CVE-2017-9993

References for CVE-2017-9993