CVE-2016-1897
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by...
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
- Record
CVE-2016-1897- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
- Record
CVE-2016-1897- Updated
- 2026-11-02
EUVDEUVD-2016-2991 No score
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
- Record
EUVD-2016-2991- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4p87-h585-c5xj
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by...
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
- Record
GHSA-4p87-h585-c5xj- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
- Record
CVE-2016-1897- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-07
OSVDEBIAN-CVE-2016-1897
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
- Record
DEBIAN-CVE-2016-1897- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2016-1897
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.
- Record
UBUNTU-CVE-2016-1897- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2016-0060 No score
Updated ffmpeg packages fix security vulnerabilities
Updated ffmpeg packages fix security vulnerabilities:
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file (CVE-2016-1897).
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file (CVE-2016-1898).
Out-of-array read in FFmpeg before 2.4.13 in jpeg2000_decode_tile() in jpeg2000dec.c (CVE-2016-2213).
- Record
MGASA-2016-0060- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10243-1 No score
ffmpeg-3.2.2-1.1 on GA media
These are all security issues fixed in the ffmpeg-3.2.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10243-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10754-1 No score
ffmpeg-4-4.4-5.2 on GA media
These are all security issues fixed in the ffmpeg-4-4.4-5.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10754-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegDebian:12 |
before 7:2.8.5-1 | 7:2.8.5-1 |
ffmpegDebian:13 |
before 7:2.8.5-1 | 7:2.8.5-1 |
ffmpegDebian:14 |
before 7:2.8.5-1 | 7:2.8.5-1 |
libavDebian:7 From an advisory covering 3 CVEs |
before 6:0.8.17-2, plus listed versions 6:0.8.10-16:0.8.12-16:0.8.13-16:0.8.15-16:0.8.16-1 Show 5 moreShow less6:0.8.17-16:0.8.6-16:0.8.7-16:0.8.8-16:0.8.9-1 |
6:0.8.17-2 |
libavDebian:8 From an advisory covering 3 CVEs |
before 6:11.6-1~deb8u1, plus listed versions 6:11.3-16:11.3-1+deb8u16:11.3-26:11.3-36:11.4-16:11.4-1~deb8u16:11.4-26:11.4-2+x32.1 |
6:11.6-1~deb8u1 |
ffmpegMageia:5 From an advisory covering 3 CVEs |
before 2.4.13-1.mga5 | 2.4.13-1.mga5 |
ffmpegMageia:5 From an advisory covering 3 CVEs |
before 2.4.13-1.mga5.tainted | 2.4.13-1.mga5.tainted |
libavUbuntu:Pro:14.04:LTS |
before 6:9.20-0ubuntu0.14.04.1+esm1, plus listed versions 6:0.8.7-1ubuntu26:9.10-1ubuntu16:9.10-1ubuntu26:9.10-1ubuntu56:9.10-1ubuntu6 Show 8 moreShow less6:9.10-1ubuntu76:9.11-2ubuntu16:9.11-2ubuntu26:9.13-0ubuntu0.14.04.16:9.14-0ubuntu0.14.04.16:9.16-0ubuntu0.14.04.16:9.18-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.1 |
6:9.20-0ubuntu0.14.04.1+esm1 |
ffmpegUbuntu:16.04:LTS |
before 7:2.8.6-1ubuntu1, plus listed versions 7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1 Show 4 moreShow less7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu4 |
7:2.8.6-1ubuntu1 |
ffmpeg-4openSUSE:Tumbleweed From an advisory covering 46 CVEs |
before 4.4-5.2 | 4.4-5.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-1897 is a medium vulnerability (CVSS 5.5) in Ffmpeg, published January 14, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 14.6%, the 96th percentile. Fixed in ffmpeg 7:2.8.5-1.
References
security.stackexchange.com/questions/110644
lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.html
securitytracker.com/id/1034932
security.gentoo.org/glsa/201705-08
securityfocus.com/bid/80501
ubuntu.com/usn/USN-2944-1
Show 67 moreShow less
openwall.com/lists/oss-security/2016/01/14/1
slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.529036
debian.org/security/2016/dsa-3506
habrahabr.ru/company/mailru/blog/274855
kb.cert.org/vuls/id/772447
nvd.nist.gov/vuln/detail/CVE-2016-1897
github.com/advisories/GHSA-4p87-h585-c5xj
security-tracker.debian.org/tracker/CVE-2016-1897
advisories.mageia.org/MGASA-2016-0060.html
bugs.mageia.org/show_bug.cgi?id=17539
openwall.com/lists/oss-security/2016/02/03/2
git.videolan.org?p=ffmpeg.git;a=shortlog;h=n2.4.13
ffmpeg.org/download.html
ubuntu.com/security/CVE-2016-1897
cve.org/CVERecord?id=CVE-2016-1897
suse.com/security/cve/CVE-2015-8216