CVE-2016-1898
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by...
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.
- Record
CVE-2016-1898- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.
- Record
CVE-2016-1898- Updated
- 2026-11-02
EUVDEUVD-2016-2992 No score
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.
- Record
EUVD-2016-2992- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2mw9-cpc8-cf9f
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by...
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.
- Record
GHSA-2mw9-cpc8-cf9f- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.
- Record
CVE-2016-1898- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-07
OSVDEBIAN-CVE-2016-1898
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.
- Record
DEBIAN-CVE-2016-1898- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-1898
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.
- Record
UBUNTU-CVE-2016-1898- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2016-0060 No score
Updated ffmpeg packages fix security vulnerabilities
Updated ffmpeg packages fix security vulnerabilities:
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file (CVE-2016-1897).
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file (CVE-2016-1898).
Out-of-array read in FFmpeg before 2.4.13 in jpeg2000_decode_tile() in jpeg2000dec.c (CVE-2016-2213).
- Record
MGASA-2016-0060- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10243-1 No score
ffmpeg-3.2.2-1.1 on GA media
These are all security issues fixed in the ffmpeg-3.2.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10243-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegDebian:12 |
before 7:2.8.5-1 | 7:2.8.5-1 |
ffmpegDebian:13 |
before 7:2.8.5-1 | 7:2.8.5-1 |
ffmpegDebian:14 |
before 7:2.8.5-1 | 7:2.8.5-1 |
libavDebian:7 From an advisory covering 3 CVEs |
before 6:0.8.17-2, plus listed versions 6:0.8.10-16:0.8.12-16:0.8.13-16:0.8.15-16:0.8.16-1 Show 5 moreShow less6:0.8.17-16:0.8.6-16:0.8.7-16:0.8.8-16:0.8.9-1 |
6:0.8.17-2 |
libavDebian:8 From an advisory covering 3 CVEs |
before 6:11.6-1~deb8u1, plus listed versions 6:11.3-16:11.3-1+deb8u16:11.3-26:11.3-36:11.4-16:11.4-1~deb8u16:11.4-26:11.4-2+x32.1 |
6:11.6-1~deb8u1 |
ffmpegMageia:5 From an advisory covering 3 CVEs |
before 2.4.13-1.mga5 | 2.4.13-1.mga5 |
ffmpegMageia:5 From an advisory covering 3 CVEs |
before 2.4.13-1.mga5.tainted | 2.4.13-1.mga5.tainted |
libavUbuntu:Pro:14.04:LTS |
before 6:9.20-0ubuntu0.14.04.1+esm1, plus listed versions 6:0.8.7-1ubuntu26:9.10-1ubuntu16:9.10-1ubuntu26:9.10-1ubuntu56:9.10-1ubuntu6 Show 8 moreShow less6:9.10-1ubuntu76:9.11-2ubuntu16:9.11-2ubuntu26:9.13-0ubuntu0.14.04.16:9.14-0ubuntu0.14.04.16:9.16-0ubuntu0.14.04.16:9.18-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.1 |
6:9.20-0ubuntu0.14.04.1+esm1 |
ffmpegUbuntu:16.04:LTS |
before 7:2.8.6-1ubuntu1, plus listed versions 7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1 Show 4 moreShow less7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu4 |
7:2.8.6-1ubuntu1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-1898 is a medium vulnerability (CVSS 5.5) in Ffmpeg, published January 14, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 13.0%, the 96th percentile. Fixed in ffmpeg 7:2.8.5-1.
References
lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.html
securitytracker.com/id/1034932
security.gentoo.org/glsa/201705-08
securityfocus.com/bid/80501
ubuntu.com/usn/USN-2944-1
openwall.com/lists/oss-security/2016/01/14/1
Show 29 moreShow less
slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.529036
debian.org/security/2016/dsa-3506
habrahabr.ru/company/mailru/blog/274855
kb.cert.org/vuls/id/772447
nvd.nist.gov/vuln/detail/CVE-2016-1898
github.com/advisories/GHSA-2mw9-cpc8-cf9f
security-tracker.debian.org/tracker/CVE-2016-1898
advisories.mageia.org/MGASA-2016-0060.html
bugs.mageia.org/show_bug.cgi?id=17539
openwall.com/lists/oss-security/2016/02/03/2
git.videolan.org?p=ffmpeg.git;a=shortlog;h=n2.4.13
ffmpeg.org/download.html
ubuntu.com/security/CVE-2016-1898
cve.org/CVERecord?id=CVE-2016-1898
suse.com/security/cve/CVE-2015-8216