FFmpeg CVE-2017-9993 Arbitrary File Read Vulnerability

Bugtraq ID:	99315
Class:	Input Validation Error
CVE:	CVE-2017-9993
Remote:	Yes
Local:	No
Published:	Jun 28 2017 12:00AM
Updated:	Aug 29 2017 06:12AM
Credit:	Thierry Foucu
Vulnerable:	FFmpeg FFmpeg 3.3.1 FFmpeg FFmpeg 3.2.2 FFmpeg FFmpeg 3.1.6 FFmpeg FFmpeg 3.1.2 FFmpeg FFmpeg 3.1.1 FFmpeg FFmpeg 3.1 FFmpeg FFmpeg 3.0.5 FFmpeg FFmpeg 2.8.10 FFmpeg FFmpeg 2.8.5 FFmpeg FFmpeg 2.8.4 FFmpeg FFmpeg 2.8.3 FFmpeg FFmpeg 2.8.2 FFmpeg FFmpeg 2.8.1 FFmpeg FFmpeg 2.8 FFmpeg FFmpeg 3.1.4 FFmpeg FFmpeg 3.1.3 FFmpeg FFmpeg 3.0.4 FFmpeg FFmpeg 3.0.3 FFmpeg FFmpeg 2.8.9 FFmpeg FFmpeg 2.8.8 FFmpeg FFmpeg 2.8.6 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	FFmpeg FFmpeg 3.3.2 FFmpeg FFmpeg 3.2.6 FFmpeg FFmpeg 3.1.9 FFmpeg FFmpeg 2.8.12

FFmpeg CVE-2017-9993 Arbitrary File Read Vulnerability

FFmpeg is prone to a security vulnerability that allows remote attackers to read arbitrary files.

Successful exploits may allow an attacker to read arbitrary files in the context of the user running the affected application. This may aid in further attacks.

FFmpeg prior to 2.8.12, 3.0.x and 3.1.x prior to 3.1.9, 3.2.x prior to 3.2.6, and 3.3.x prior to 3.3.2 are vulnerable.

FFmpeg CVE-2017-9993 Arbitrary File Read Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

FFmpeg CVE-2017-9993 Arbitrary File Read Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

FFmpeg CVE-2017-9993 Arbitrary File Read Vulnerability

References:

• avformat/avidec: Limit formats in gab2 to srt and ass/ssa (FFmpeg)
  
• avformat/hls: Check local file extensions (FFmpeg)
  
• FFmpeg Homepage (FFmpeg )