Candidate: CVE-2017-9993
PublicDate: 2017-06-28 06:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9993
 https://github.com/FFmpeg/FFmpeg/commit/189ff4219644532bdfa7bab28dfedaee4d6d4021
 https://github.com/FFmpeg/FFmpeg/commit/a5d849b149ca67ced2d271dc84db0bc95a548abb
Description:
 FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and
 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename
 extensions and demuxer names, which allows attackers to read arbitrary
 files via crafted playlist data.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by: Emil Lerner and Pavel Cheremushkin
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N [7.5 HIGH]

Patches_libav:
upstream_libav: needs-triage
precise/esm_libav: DNE
trusty_libav: ignored (reached end-of-life)
trusty/esm_libav: DNE (trusty was needed)
vivid/ubuntu-core_libav: DNE
xenial_libav: DNE
yakkety_libav: DNE
zesty_libav: DNE
artful_libav: DNE
bionic_libav: DNE
cosmic_libav: DNE
disco_libav: DNE
devel_libav: DNE

Patches_ffmpeg:
upstream_ffmpeg: released (7:3.2.6-1)
precise/esm_ffmpeg: DNE
trusty_ffmpeg: DNE
trusty/esm_ffmpeg: DNE
vivid/ubuntu-core_ffmpeg: DNE
xenial_ffmpeg: released (7:2.8.14-0ubuntu0.16.04.1)
yakkety_ffmpeg: ignored (reached end-of-life)
zesty_ffmpeg: ignored (reached end-of-life)
artful_ffmpeg: not-affected (7:3.2.6-1)
bionic_ffmpeg: not-affected (7:3.2.6-1)
cosmic_ffmpeg: not-affected (7:3.2.6-1)
disco_ffmpeg: not-affected (7:3.2.6-1)
devel_ffmpeg: not-affected (7:3.2.6-1)