CVE-2017-9993
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2017-9993
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-9993.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2017-9993
- Downstream
- Related
- Published
- 2017-06-28T06:29:00Z
- Modified
- 2025-07-01T04:30:34.571277Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
- References
-
- http://www.debian.org/security/2017/dsa-3957
- http://www.securityfocus.com/bid/99315
- https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html
- https://github.com/FFmpeg/FFmpeg/commit/189ff4219644532bdfa7bab28dfedaee4d6d4021
- https://github.com/FFmpeg/FFmpeg/commit/a5d849b149ca67ced2d271dc84db0bc95a548abb
- https://security.alpinelinux.org/vuln/CVE-2017-9993
- https://security-tracker.debian.org/tracker/CVE-2017-9993
Affected packages
Alpine:v3.4 / ffmpeg
Package
- Name
- ffmpeg
- Purl
- pkg:apk/alpine/ffmpeg?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed3.1.9-r0
Affected versions
0.*
0.5-r0
0.6-r0
0.6-r1
0.6-r2
0.6.1-r0
0.6.1-r1
0.6.2-r0
0.6.2-r1
0.6.2-r2
0.6.3-r0
0.6.3-r1
0.6.3-r2
0.8-r0
0.8.1-r0
0.8.2-r0
0.8.3-r0
0.8.4-r0
0.8.5-r0
0.8.5-r1
0.8.6-r0
0.8.7-r0
0.9-r0
0.9.1-r0
0.10-r0
0.10-r1
0.10-r2
0.10.2-r0
0.11-r0
0.11.1-r0
0.11.1-r1
0.11.2-r1
1.*
1.0-r0
1.0-r1
1.0-r2
1.0.1-r0
1.0.1-r1
1.1-r1
1.1.2-r1
1.1.2-r2
1.1.2-r3
1.1.3-r0
1.1.4-r0
1.2-r0
1.2-r1
1.2.1-r0
1.2.2-r0
1.2.4-r0
2.*
2.0.2-r0
2.1-r0
2.1.1-r0
2.1.3-r0
2.1.4-r0
2.2-r0
2.2.2-r0
2.2.3-r0
2.2.4-r0
2.2.4-r1
2.2.4-r2
2.2.4-r3
2.3-r0
2.3.1-r0
2.3.2-r0
2.3.3-r0
2.3.4-r0
2.3.4-r1
2.3.4-r2
2.3.5-r0
2.5.1-r0
2.5.2-r0
2.5.2-r1
2.5.3-r0
2.5.4-r0
2.6.1-r0
2.6.2-r0
2.6.2-r1
2.6.2-r2
2.6.3-r0
2.7-r0
2.7.1-r0
2.7.1-r1
2.7.2-r0
2.8-r0
2.8-r1
2.8-r2
2.8.1-r0
2.8.2-r0
2.8.2-r1
2.8.3-r0
2.8.5-r0
3.*
3.0.1-r0
3.0.2-r0
3.0.2-r1
3.0.7-r0
Alpine:v3.5 / ffmpeg
Package
- Name
- ffmpeg
- Purl
- pkg:apk/alpine/ffmpeg?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed3.1.9-r0
Affected versions
0.*
0.5-r0
0.6-r0
0.6-r1
0.6-r2
0.6.1-r0
0.6.1-r1
0.6.2-r0
0.6.2-r1
0.6.2-r2
0.6.3-r0
0.6.3-r1
0.6.3-r2
0.8-r0
0.8.1-r0
0.8.2-r0
0.8.3-r0
0.8.4-r0
0.8.5-r0
0.8.5-r1
0.8.6-r0
0.8.7-r0
0.9-r0
0.9.1-r0
0.10-r0
0.10-r1
0.10-r2
0.10.2-r0
0.11-r0
0.11.1-r0
0.11.1-r1
0.11.2-r1
1.*
1.0-r0
1.0-r1
1.0-r2
1.0.1-r0
1.0.1-r1
1.1-r1
1.1.2-r1
1.1.2-r2
1.1.2-r3
1.1.3-r0
1.1.4-r0
1.2-r0
1.2-r1
1.2.1-r0
1.2.2-r0
1.2.4-r0
2.*
2.0.2-r0
2.1-r0
2.1.1-r0
2.1.3-r0
2.1.4-r0
2.2-r0
2.2.2-r0
2.2.3-r0
2.2.4-r0
2.2.4-r1
2.2.4-r2
2.2.4-r3
2.3-r0
2.3.1-r0
2.3.2-r0
2.3.3-r0
2.3.4-r0
2.3.4-r1
2.3.4-r2
2.3.5-r0
2.5.1-r0
2.5.2-r0
2.5.2-r1
2.5.3-r0
2.5.4-r0
2.6.1-r0
2.6.2-r0
2.6.2-r1
2.6.2-r2
2.6.3-r0
2.7-r0
2.7.1-r0
2.7.1-r1
2.7.2-r0
2.8-r0
2.8-r1
2.8-r2
2.8.1-r0
2.8.2-r0
2.8.2-r1
2.8.3-r0
2.8.5-r0
3.*
3.0.1-r0
3.0.2-r0
3.0.2-r1
3.1-r0
3.1.1-r0
3.1.2-r0
3.1.3-r0
3.1.4-r0
3.1.6-r0
3.1.7-r0
Alpine:v3.6 / ffmpeg
Package
- Name
- ffmpeg
- Purl
- pkg:apk/alpine/ffmpeg?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed3.2.6-r0
Affected versions
0.*
0.5-r0
0.6-r0
0.6-r1
0.6-r2
0.6.1-r0
0.6.1-r1
0.6.2-r0
0.6.2-r1
0.6.2-r2
0.6.3-r0
0.6.3-r1
0.6.3-r2
0.8-r0
0.8.1-r0
0.8.2-r0
0.8.3-r0
0.8.4-r0
0.8.5-r0
0.8.5-r1
0.8.6-r0
0.8.7-r0
0.9-r0
0.9.1-r0
0.10-r0
0.10-r1
0.10-r2
0.10.2-r0
0.11-r0
0.11.1-r0
0.11.1-r1
0.11.2-r1
1.*
1.0-r0
1.0-r1
1.0-r2
1.0.1-r0
1.0.1-r1
1.1-r1
1.1.2-r1
1.1.2-r2
1.1.2-r3
1.1.3-r0
1.1.4-r0
1.2-r0
1.2-r1
1.2.1-r0
1.2.2-r0
1.2.4-r0
2.*
2.0.2-r0
2.1-r0
2.1.1-r0
2.1.3-r0
2.1.4-r0
2.2-r0
2.2.2-r0
2.2.3-r0
2.2.4-r0
2.2.4-r1
2.2.4-r2
2.2.4-r3
2.3-r0
2.3.1-r0
2.3.2-r0
2.3.3-r0
2.3.4-r0
2.3.4-r1
2.3.4-r2
2.3.5-r0
2.5.1-r0
2.5.2-r0
2.5.2-r1
2.5.3-r0
2.5.4-r0
2.6.1-r0
2.6.2-r0
2.6.2-r1
2.6.2-r2
2.6.3-r0
2.7-r0
2.7.1-r0
2.7.1-r1
2.7.2-r0
2.8-r0
2.8-r1
2.8-r2
2.8.1-r0
2.8.2-r0
2.8.2-r1
2.8.3-r0
2.8.5-r0
3.*
3.0.1-r0
3.0.2-r0
3.0.2-r1
3.1-r0
3.1.1-r0
3.1.2-r0
3.1.3-r0
3.1.4-r0
3.1.6-r0
3.2.2-r0
3.2.2-r1
3.2.4-r0
3.2.4-r1
Debian:11 / ffmpeg
Package
- Name
- ffmpeg
- Purl
- pkg:deb/debian/ffmpeg?arch=source
Debian:12 / ffmpeg
Package
- Name
- ffmpeg
- Purl
- pkg:deb/debian/ffmpeg?arch=source
Debian:13 / ffmpeg
Package
- Name
- ffmpeg
- Purl
- pkg:deb/debian/ffmpeg?arch=source
Git / git.ffmpeg.org/ffmpeg.git
Affected ranges
- Type
- GIT
- Repo
- https://git.ffmpeg.org/ffmpeg.git
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Type
- GIT
- Repo
- https://github.com/ffmpeg/ffmpeg
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
Affected versions
Other
N
n0.*
n0.11-dev
n0.12-dev
n0.8
n1.*
n1.1-dev
n1.2-dev
n1.3-dev
n2.*
n2.0
n2.1-dev
n2.2-dev
n2.3-dev
n2.4-dev
n2.5-dev
n2.6-dev
n2.7-dev
n2.8
n2.8-dev
n2.8.1
n2.8.10
n2.8.11
n2.8.2
n2.8.3
n2.8.4
n2.8.5
n2.8.6
n2.8.7
n2.8.8
n2.8.9
n2.9-dev
n3.*
n3.1-dev
n3.2-dev
n3.3-dev
n3.4-dev