CVE-2017-9993: debian debian_linux
CVSS: 7.5v3.0HighModified
AliasesALPINE-CVE-2017-9993UBUNTU-CVE-2017-9993DEBIAN-CVE-2017-9993CGA-254x-vwwc-j895CGA-33h5-3qmg-8vmvCGA-66xx-jq9g-c2f2CGA-95g5-4w24-fc4jCGA-jj92-vg4f-x9h6CGA-q443-mc4g-vmwwCGA-wvjp-m6hp-w9cgCGA-wwgc-pv6g-ffqw
Published 28-06-2017Last modified 05-08-2024
Vulnerability summary
CVE-2017-9993 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 16.44% chance of exploitation in the next 30 days, higher than 96.9% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.0 (NVD)EPSS score
16.44%
0%100%
Medium · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3Timeline
- 28-06-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
16.44%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 16.44% on 18-09-2026
18-09-202618-10-2026
EPSS score16.44%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard4 products
- torchaudio-ffmpeg-tarballsAll versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-4.4.4All versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-5.0.3All versions (No fix recorded)
- torchaudio-ffmpeg-tarballs-6.0All versions (No fix recorded)
Debian2 products
- ffmpeg< 7:3.2.6-1
- debian_linuxEOL8.0 | 9.0
Ubuntu2 products
- ffmpeg< 7:2.8.14-0ubuntu0.16.04.1
- libavAll versions (No fix recorded)
Alpine1 product
- ffmpeg≥ 3.0, < 3.1.9-r0 | ≥ 3.0, < 3.2.6-r0
Ffmpeg1 product
- ffmpeg< 2.8.12 | ≥ 3.0, < 3.1.9 | ≥ 3.2, < 3.2.6 | ≥ 3.3, < 3.3.2
5 vendors · 10 products
References
9 links- github.com/FFmpeg/FFmpeg/commit/a5d849b149ca67ced2d271dc84db0bc95a548abbX Refsource MISCIssue TrackingPatchThird Party AdvisoryREPORTFIX
- github.com/FFmpeg/FFmpeg/commit/189ff4219644532bdfa7bab28dfedaee4d6d4021X Refsource MISCIssue TrackingPatchThird Party AdvisoryREPORTFIX
- lists.debian.org/debian-lts-announce/2019/01/msg00006.htmlMailing ListX Refsource MLISTThird Party AdvisoryAdvisory