CVE-2017-9993
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2...
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
- Record
CVE-2017-9993- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
- Record
CVE-2017-9993- Updated
- 2026-11-02
EUVDEUVD-2017-18902 No score
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
- Record
EUVD-2017-18902- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-935f-c84q-vhpw
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2...
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
- Record
GHSA-935f-c84q-vhpw- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-9993
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
- Record
ALPINE-CVE-2017-9993- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSV
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
- Record
CVE-2017-9993- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-9993
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
- Record
DEBIAN-CVE-2017-9993- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-9993
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
- Record
UBUNTU-CVE-2017-9993- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2018-0008 No score
Updated ffmpeg packages fix security vulnerability
This update provides ffmpeg version 2.4.14, which fixes several security vulnerabilities and other bugs which were corrected upstream.
- Record
MGASA-2018-0008- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegAlpine:v3.4 |
3.0 up to 3.1.9-r0 | 3.1.9-r0 |
ffmpegAlpine:v3.5 |
3.0 up to 3.1.9-r0 | 3.1.9-r0 |
ffmpegAlpine:v3.6 |
3.0 up to 3.2.6-r0 | 3.2.6-r0 |
ffmpegDebian:12 |
before 7:3.2.6-1 | 7:3.2.6-1 |
ffmpegDebian:13 |
before 7:3.2.6-1 | 7:3.2.6-1 |
ffmpegDebian:14 |
before 7:3.2.6-1 | 7:3.2.6-1 |
libavDebian:8 |
before 6:11.12-1~deb8u4, plus listed versions 6:11.11-1~deb8u16:11.12-1~deb8u16:11.12-1~deb8u26:11.12-1~deb8u36:11.3-1 Show 11 moreShow less6:11.3-1+deb8u16:11.3-26:11.3-36:11.4-16:11.4-1~deb8u16:11.4-26:11.4-2+x32.16:11.6-1~deb8u16:11.7-1~deb8u16:11.8-1~deb8u16:11.9-1~deb8u1 |
6:11.12-1~deb8u4 |
ffmpegDebian:9 |
before 7:3.2.7-1~deb9u1, plus listed versions 7:3.2.5-17:3.2.6-1 |
7:3.2.7-1~deb9u1 |
ffmpegMageia:5 |
before 2.4.14-1.mga5 | 2.4.14-1.mga5 |
ffmpegMageia:5 |
before 2.4.14-1.mga5.tainted | 2.4.14-1.mga5.tainted |
libavUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 6:0.8.7-1ubuntu26:9.10-1ubuntu16:9.10-1ubuntu26:9.10-1ubuntu56:9.10-1ubuntu6 Show 9 moreShow less6:9.10-1ubuntu76:9.11-2ubuntu16:9.11-2ubuntu26:9.13-0ubuntu0.14.04.16:9.14-0ubuntu0.14.04.16:9.16-0ubuntu0.14.04.16:9.18-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.1+esm1 |
None known |
ffmpegUbuntu:16.04:LTS |
before 7:2.8.14-0ubuntu0.16.04.1, plus listed versions 7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1 Show 9 moreShow less7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.1 |
7:2.8.14-0ubuntu0.16.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-9993 is a high vulnerability (CVSS 7.5) in Ffmpeg, published June 28, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.4%, the 96th percentile. Fixed in ffmpeg 3.1.9-r0.
References
github.com/FFmpeg/FFmpeg/commit/a5d849b149ca67ced2d271dc84db0bc95a548abb
debian.org/security/2017/dsa-3957
securityfocus.com/bid/99315
lists.debian.org/debian-lts-announce/2019/01/msg00006.html
nvd.nist.gov/vuln/detail/CVE-2017-9993