CVE-2017-9993
HIGH7.5EPSS 56.2%發布日:2017/6/28修改日:2026/4/28
描述
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
受影響套件(2)
- Alpine/ffmpegfrom 0, < 3.1.9-r0
- Debian/ffmpegfrom 0, < 7:3.2.6-1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |