Executive Summary

Title ffmpeg and Libav cross-domain information disclosure vulnerability
Name VU#772447 First vendor Publication 2016-01-20
Vendor VU-CERT Last vendor Modification 2016-01-21
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores


Vulnerability Note VU#772447

ffmpeg and Libav cross-domain information disclosure vulnerability

Original Release date: 20 Jan 2016 | Last revised: 21 Jan 2016


ffmpeg is a "cross-platform solution to record, convert and stream audio and video". ffmpeg is vulnerable to local file disclosure due to improper enforcement of domain restrictions when processing playlist files.


CWE-201: Information Exposure Through Sent Data - CVE-2016-1897, CVE-2016-1898

When a user opens a maliciously crafted playlist file in ffmpeg, ffmpeg will query a server for remote data. By carefully crafting the playlist, an attacker can cause ffmpeg to request internet URIs that expose file:// content from the victim's machine. CVE-2016-1897 refers to an issue with processing playlists that use concatenations, while CVE-2016-1898 refers to a related issue with subfiles.

According to a mailing list post from MITRE's CVE team:

    The essential problem is that a crafted file forces the victim to visit an arbitrary external URL, but this URL is constructed using data from the victim's local filesystem.

More details are provided by the researcher in a blog post (in Russian).

Libav is a fork of ffmpeg and is also vulnerable.


By causing a specially-crafted playlist file to be processed with ffmpeg or Libav, a remote attacker may acquire file contents from a vulnerable system. In some circumstances, this may occur without explicit user interaction (such as the creation of a thumbnail preview by a file manager).


Apply an update

ffmpeg version 2.8.5 has been released to address this issue. Affected users are encouraged to update as soon as possible.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
Alpine LinuxAffected-20 Jan 2016
Arch LinuxAffected20 Jan 201620 Jan 2016
Debian GNU/LinuxAffected20 Jan 201620 Jan 2016
ffmpegAffected-20 Jan 2016
Gentoo LinuxAffected20 Jan 201620 Jan 2016
LibavAffected-20 Jan 2016
SUSE LinuxAffected20 Jan 201620 Jan 2016
UbuntuAffected20 Jan 201620 Jan 2016
VideoLANAffected-21 Jan 2016
CentOSNot Affected20 Jan 201621 Jan 2016
OmniTINot Affected20 Jan 201620 Jan 2016
Red Hat, Inc.Not Affected20 Jan 201621 Jan 2016
AppleUnknown20 Jan 201620 Jan 2016
CoreOSUnknown20 Jan 201620 Jan 2016
DesktopBSDUnknown20 Jan 201620 Jan 2016
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)



  • http://habrahabr.ru/company/mailru/blog/274855
  • http://www.openwall.com/lists/oss-security/2016/01/14/1


This vulnerability was publicly disclosed by Maxim Andreev.

This document was written by Garret Wassermann and Will Dormann.

Other Information

  • CVE IDs:CVE-2016-1897CVE-2016-1898
  • Date Public:12 Jan 2016
  • Date First Published:20 Jan 2016
  • Date Last Updated:21 Jan 2016
  • Document Revision:46


If you have feedback, comments, or additional information about this vulnerability, please send us email.

Original Source

Url : http://www.kb.cert.org/vuls/id/772447

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-200 Information Exposure

CPE : Common Platform Enumeration

Application 82
Os 1
Os 1

Nessus® Vulnerability Scanner

Date Description
2017-05-10 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201705-08.nasl - Type : ACT_GATHER_INFO
2016-06-20 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201606-09.nasl - Type : ACT_GATHER_INFO
2016-04-05 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2944-1.nasl - Type : ACT_GATHER_INFO
2016-03-07 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3506.nasl - Type : ACT_GATHER_INFO
2016-02-04 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2016-034-02.nasl - Type : ACT_GATHER_INFO
2016-01-27 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-94.nasl - Type : ACT_GATHER_INFO
2016-01-19 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_046fedd1bd0111e5bbf45404a68ad561.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
Date Informations
2016-01-22 05:26:39
  • Multiple Updates
2016-01-22 05:22:12
  • Multiple Updates
2016-01-21 17:26:21
  • Multiple Updates
2016-01-21 17:21:53
  • Multiple Updates
2016-01-21 00:26:10
  • Multiple Updates
2016-01-21 00:21:29
  • Multiple Updates
2016-01-20 21:26:14
  • Multiple Updates
2016-01-20 21:21:02
  • First insertion