CVE-2017-9993
HIGHFFmpeg < 2.8.12, 3.0.x-3.1.8, 3.2.x-3.2.5, 3.3.x-3.3.1 - Arbitrary File Read via Crafted HLS Playlist Data
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2017-9993. PoCs published by qazbnm456, xbl3.
AI-analyzed exploit summary This repository provides a detailed writeup and references for CVE-2017-9993, a local file disclosure vulnerability in FFmpeg. It includes links to the original HackerOne report, technical discussions, and patches but does not contain functional exploit code.
Description
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
Exploits (2)
This repository provides a detailed writeup and references for CVE-2017-9993, a local file disclosure vulnerability in FFmpeg. It includes links to the original HackerOne report, technical discussions, and patches but does not contain functional exploit code.
This repository provides a detailed writeup and references for CVE-2017-9993, a local file disclosure vulnerability in FFmpeg. It includes links to the original HackerOne report, technical discussions, and patches, but does not contain functional exploit code.
References (5)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N