CVE-2017-9993
7.5
HIGH
CVSS 3.1
EPSS 16.4%
Description
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
How to fix CVE-2017-9993
To remediate CVE-2017-9993, upgrade the affected package to a fixed version below.
- Alpine/ffmpeg—upgrade to 3.1.9-r0 or later
Is CVE-2017-9993 being exploited?
Moderate — EPSS is 16.4%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (1)
- >= 3.0, < 3.1.9-r0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |