CVE-2016-1898

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.

References

Affected packages

Debian:11 / ffmpeg

Package

Name: ffmpeg
Purl: pkg:deb/debian/ffmpeg?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7:2.8.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / ffmpeg

Package

Name: ffmpeg
Purl: pkg:deb/debian/ffmpeg?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7:2.8.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / ffmpeg

Package

Name: ffmpeg
Purl: pkg:deb/debian/ffmpeg?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7:2.8.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/ffmpeg/ffmpeg

Affected ranges

Type: GIT
Repo: https://github.com/ffmpeg/ffmpeg
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

0045969e411bcf946b2393e7bcb42032cb71a9a1

Last affected

043f32606046b1470218511ded151edfa7a126ee

Last affected

04fd0250e1fd3fddcd7bc96c8ac95455f910637e

Last affected

051cd7dc5f42542753f809109d00ec3cf19eb337

Last affected

07d508e4f55f6045b83df3346448b149faab5d7d

Last affected

0bcb6ac150690d1b799982efabc11cab3420f3e3

Last affected

0caff57c42cac0f80152187473b1ee753aca8257

Last affected

0edc79962641dd853cda187ee13b617701346061

Last affected

1047c286fa20c79dde8ddd7577a3b87cc1effdb7

Last affected

13a72d9b08c914c3d3c99be1053e9d5cda8baa88

Last affected

15466db69e60f486c44e4c3e680d27c951f125d7

Last affected

1b99667005156cadc8d3ae0099ef5d244e598ac5

Last affected

1c14b09caf903f2e776dcd661085db49511bf531

Last affected

1eb646ec9f87ed488f52561867e107eaee89e20c

Last affected

1fd7fb9036fcfb1620068014d8a52112067d2d59

Last affected

205e2264c3d5b1a16a4493b9281b9167d09c3505

Last affected

21d0ae829f72ec327aff31b0cb1af1261b56596c

Last affected

26241af6f8b291eed42c597ffa2b32802331f813

Last affected

27172a5ca360e61a07ff16bf22f2ec91208f4e00

Last affected

29353dd3f8159089ecf2fa0886f94f4cf32e75f2

Last affected

2b8b2ba19fe0ca6594cb09439b9ead2c328a79d8

Last affected

2c01dd2ea5e39238261945185d2b30e11979cf4b

Last affected

2c8c55195da97ee45fb0daf6d68c22b942e14ade

Last affected

3429714f3d046f4e2235848a60b6f63bd084e01f

Last affected

36cfee3adc70c6a78a07df4bb16349c4b0893ef4

Last affected

3c63503792147a996997023694a3b45f27ab3f78

Last affected

3d91569c5e39f4062393fdb40b038e31df38473a

Last affected

3ec3f70ddb1b97fd6174ab3ca8617d8a1a6516ab

Last affected

40934e0e9b632fa6c6ec22ac03b530625a027c79

Last affected

41802887eb647bee21238e0a575a7c4bbf954b86

Last affected

48d388b03336d01e0db9b729f9f82cbadf3af7bd

Last affected

49fa398858df1a1e425740672de5fb4819b4d947

Last affected

4afe2684d8f50b28ce6743c7ee999f3157c9857f

Last affected

58142a27ea96bf9246586a91a82db85e37646933

Last affected

5df02760dd2f050b996f931fa7cdf8871bfa5d96

Last affected

5e4ec87720a64cd969120af60e82cbd55454ab8e

Last affected

620197d1ffea20e9168372c354438f1c1e926ecd

Last affected

644179e0d4155ae8f5ddd5c3f6bd003e2e13cf94

Last affected

644296e736ee219cd02f7b7d7b7b4c7c5a464217

Last affected

68f89b8264d46d5812e710ca0f903d4d323ec899

Last affected

6baf9c4406bcdf1015c9ec8bd6b8c4aef77624ac

Last affected

7c2d152f562ab089ecf8262438e2f8e9cb9c546f

Last affected

7de7bd4f563a1431bdac59dae5d8e930e71405e6

Last affected

86a01362c0e46d155fbfc1ef19f5ba17af3ee69d

Last affected

93f3752b970cc7c9e1a360037fff1ddb9dcbb86e

Last affected

9422cd85a081f6e084731e87eda3e8e4df9f6827

Last affected

959ab06c68f8c74a0f31bcaf2692cbbdaf5702f6

Last affected

969aee07e68c5930782bc46f2ac2391db55b8d1b

Last affected

9d0bb7fc3991b030603acfe899e6f001e530c89a

Last affected

9f09bfe681259cfed7414f207c88f84c09d5b501

Last affected

a37e42b3ee4226a4d2c69cd4eebf9c81e6df8ea5

Last affected

acf511de34e0b79fff0183e06ed37f1aa8dc3d94

Last affected

af5917698bd44f136fd0ff00a9e5f8b5f92f2d58

Last affected

b05d3550407418aea53f2672463a8ebc8f75654e

Last affected

b17cec526214dff9d6ac1d97b70167d15a4e14d7

Last affected

b2c9cd36d34c4157af10342ad3476dd9260bbefe

Last affected

b44506c393b176dc396502ad262ac18bec52a110

Last affected

b4552cc9b8c37410f754af5d34d24e7b8a9b4b0e

Last affected

b88de7b31a4a5c35d10b1392d2d86d93fc942b4c

Last affected

bc259185cb69c6532232be4b2ad57a70ef7ed946

Last affected

bf0d2ee92c33d802907e829f99c26a46578ed679

Last affected

c2eb668617555cb8b8bcfb9796241ada9471ac65

Last affected

c9b3451da3cf632424c07c35759c9ffbd537fa9e

Last affected

d005e2ecce5c8104679b39f2050a9d83e417d275

Last affected

d0599a3516c5da31c7009af7574abbff360b9ce6

Last affected

d3139c9733f1994fb86825e0d1fd2a5abf3be7b5

Last affected

d52b5f85f2837b0de9bdefe2a650d8d1b0e02ec1

Last affected

d61454e7c1de48f6a9059ca98f55e6beb52a618c

Last affected

d6ce1cb14077891f3f6ac86cfd243835c92eb374

Last affected

da2186be81b5cb2d24da5671e25affbb8f09920d

Last affected

db27f50e0658e91758e8a17fdcf390e6bc93c1d2

Last affected

dd2394754d8cee3717b3e198c83cc382674cf126

Last affected

de7b74d2544d2cb5ff85db20a9853116ea72ed47

Last affected

e0a03d1f9cb18139ede8c3d0263a21828494c951

Last affected

e1ce4f805f31aecec83fc7c7ecaab623f3b6327f

Last affected

e72c0a04664a9aab449b63135fe16ade51a99bb6

Last affected

e7873dfccad595e9d8fc65217ebffcf3686e1d34

Last affected

eda6effcabcf9c238e4635eb058d72371336e09b

Last affected

f406bf3fa933be089bd76a95f75ea57b0942f8c5

Last affected

f478bdabf2afcd5f709789347f8a3becc4ff17bc

Last affected

faac8e43315dae5818816bcebe52d11777b064b2

Affected versions

Other

n0.*

n0.11-dev

n0.12-dev

n0.8

n1.*

n1.1-dev

n1.2-dev

n1.3-dev

n2.*

n2.0

n2.0.1

n2.0.2

n2.0.3

n2.0.4

n2.0.5

n2.0.6

n2.0.7

n2.1

n2.1-dev

n2.1.1

n2.1.2

n2.1.3

n2.1.4

n2.1.5

n2.1.6

n2.2

n2.2-dev

n2.2-rc1

n2.2-rc2

n2.2.1

n2.2.10

n2.2.11

n2.2.12

n2.2.13

n2.2.14

n2.2.15

n2.2.16

n2.2.2

n2.2.3

n2.2.4

n2.2.5

n2.2.6

n2.2.7

n2.2.8

n2.2.9

n2.3-dev

n2.4

n2.4-dev

n2.4.1

n2.4.10

n2.4.11

n2.4.2

n2.4.3

n2.4.4

n2.4.5

n2.4.6

n2.4.7

n2.4.8

n2.4.9

n2.5

n2.5-dev

n2.5.1

n2.5.2

n2.5.3

n2.6

n2.6-dev

n2.6.1

n2.6.2

n2.7-dev