{"id":"CVE-2017-9993","aliases":["ALPINE-CVE-2017-9993","DEBIAN-CVE-2017-9993","DLA-1630-1","DSA-3957-1","EUVD-2017-18902","GHSA-935f-c84q-vhpw","MGASA-2018-0008","UBUNTU-CVE-2017-9993"],"status":"published","title":"FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2...","description":"FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.16437,"percentile":0.97,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2017-06-28T06:00:00Z","modified":"2026-10-24T14:10:57Z","fixes":[{"ecosystem":"Alpine:v3.4","package":"ffmpeg","fixed_in":["3.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"ffmpeg","fixed_in":["3.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"ffmpeg","fixed_in":["3.2.6-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ffmpeg","fixed_in":["7:3.2.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:3.2.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:3.2.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"ffmpeg","fixed_in":["7:2.8.14-0ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.2.6-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.2.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.2.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.2.6-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:11.12-1~deb8u4"}]}],"versions":["6:11.11-1~deb8u1","6:11.12-1~deb8u1","6:11.12-1~deb8u2","6:11.12-1~deb8u3","6:11.3-1","6:11.3-1+deb8u1","6:11.3-2","6:11.3-3","6:11.4-1","6:11.4-1~deb8u1","6:11.4-2","6:11.4-2+x32.1","6:11.6-1~deb8u1","6:11.7-1~deb8u1","6:11.8-1~deb8u1","6:11.9-1~deb8u1"],"bundled":14},{"source":"osv","ecosystem":"Debian:9","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.2.7-1~deb9u1"}]}],"versions":["7:3.2.5-1","7:3.2.6-1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.14-1.mga5"}]}],"bundled":31},{"source":"osv","ecosystem":"Mageia:5","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.14-1.mga5.tainted"}]}],"bundled":31},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6:0.8.7-1ubuntu2","6:9.10-1ubuntu1","6:9.10-1ubuntu2","6:9.10-1ubuntu5","6:9.10-1ubuntu6","6:9.10-1ubuntu7","6:9.11-2ubuntu1","6:9.11-2ubuntu2","6:9.13-0ubuntu0.14.04.1","6:9.14-0ubuntu0.14.04.1","6:9.16-0ubuntu0.14.04.1","6:9.18-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:2.8.14-0ubuntu0.16.04.1"}]}],"versions":["7:2.7.2-1build1","7:2.8.1-1ubuntu1","7:2.8.2-1ubuntu1","7:2.8.3-1","7:2.8.4-1","7:2.8.4-1ubuntu1","7:2.8.4-1ubuntu2","7:2.8.4-1ubuntu3","7:2.8.4-1ubuntu4","7:2.8.6-1ubuntu1","7:2.8.6-1ubuntu2","7:2.8.8-0ubuntu0.16.04.1","7:2.8.10-0ubuntu0.16.04.1","7:2.8.11-0ubuntu0.16.04.1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"https://github.com/FFmpeg/FFmpeg/commit/a5d849b149ca67ced2d271dc84db0bc95a548abb","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"http://www.debian.org/security/2017/dsa-3957","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/FFmpeg/FFmpeg/commit/189ff4219644532bdfa7bab28dfedaee4d6d4021","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/99315","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9993"},{"url":"https://github.com/advisories/GHSA-935f-c84q-vhpw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-9993","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-9993","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0008.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9993","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9993","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-9993","description":"FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.","status":"published","published":"2017-06-28T06:00:00Z","modified":"2024-08-05T17:25:00.842Z","updated_at":"2026-11-02T14:33:13.96587Z"}],"euvd":[{"id":"EUVD-2017-18902","description":"FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.","status":"published","published":"2017-06-28T06:00:00Z","modified":"2024-08-05T17:25:00Z","updated_at":"2026-11-03T02:23:26.143318Z"}],"ghsa":[{"id":"GHSA-935f-c84q-vhpw","title":"FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2...","description":"FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.","status":"published","published":"2022-05-14T01:15:21Z","modified":"2023-02-02T05:03:22Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:51:37.684525Z"}],"nvd":[{"id":"CVE-2017-9993","description":"FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.","status":"published","published":"2017-06-28T06:29:00.52Z","modified":"2026-06-17T01:29:20.537Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:51.893212Z"}],"osv":[{"id":"ALPINE-CVE-2017-9993","description":"FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.","status":"published","published":"2017-06-28T06:29:00.52Z","modified":"2026-07-08T04:30:18.557290617Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"CVE-2017-9993","description":"FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.","status":"published","published":"2017-06-28T06:29:00.52Z","modified":"2026-11-07T13:28:10.407302293Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2017-9993","description":"FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.","status":"published","published":"2017-06-28T06:29:00.52Z","modified":"2026-09-01T20:03:05.303179038Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-9993","description":"FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.","status":"published","published":"2017-06-28T06:29:00Z","modified":"2026-04-22T11:38:52.410287Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DLA-1630-1","title":"libav - security update","status":"published","published":"2019-01-07T00:00:00Z","modified":"2026-03-09T01:20:24.7414Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-3957-1","title":"ffmpeg - security update","status":"published","published":"2017-08-28T00:00:00Z","modified":"2026-03-09T01:18:52.328465Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2018-0008","title":"Updated ffmpeg packages fix security vulnerability","description":"This update provides ffmpeg version 2.4.14, which fixes several security\nvulnerabilities and other bugs which were corrected upstream.\n","status":"published","published":"2018-01-01T10:38:51Z","modified":"2026-04-16T06:23:47.340588755Z","updated_at":"2026-11-02T15:49:40.442238Z"}]}}