CVE-2016-1897

5.5 MEDIUM
Published: January 15, 2016 Modified: May 06, 2026
View on NVD

Description

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://habrahabr.ru/company/mailru/blog/274855
Source: cve@mitre.org
Exploit
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.html
Source: cve@mitre.org
http://security.stackexchange.com/questions/110644
Source: cve@mitre.org
Exploit
http://www.debian.org/security/2016/dsa-3506
Source: cve@mitre.org
http://www.openwall.com/lists/oss-security/2016/01/14/1
Source: cve@mitre.org
http://www.securityfocus.com/bid/80501
Source: cve@mitre.org
http://www.securitytracker.com/id/1034932
Source: cve@mitre.org
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.529036
Source: cve@mitre.org
http://www.ubuntu.com/usn/USN-2944-1
Source: cve@mitre.org
https://security.gentoo.org/glsa/201606-09
Source: cve@mitre.org
https://security.gentoo.org/glsa/201705-08
Source: cve@mitre.org
https://www.kb.cert.org/vuls/id/772447
Source: cve@mitre.org
http://habrahabr.ru/company/mailru/blog/274855
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://security.stackexchange.com/questions/110644
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
http://www.debian.org/security/2016/dsa-3506
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.openwall.com/lists/oss-security/2016/01/14/1
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/bid/80501
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securitytracker.com/id/1034932
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.529036
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.ubuntu.com/usn/USN-2944-1
Source: af854a3a-2127-422b-91ae-364da2661108
https://security.gentoo.org/glsa/201606-09
Source: af854a3a-2127-422b-91ae-364da2661108
https://security.gentoo.org/glsa/201705-08
Source: af854a3a-2127-422b-91ae-364da2661108
https://www.kb.cert.org/vuls/id/772447
Source: af854a3a-2127-422b-91ae-364da2661108

24 reference(s) from NVD

Quick Stats

CVSS v3 Score
5.5 / 10.0
EPSS (Exploit Probability)
52.1%
98th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-200

Affected Vendors

opensuse canonical ffmpeg

Related CVEs

CVE-2026-6222 5.3
CVE-2026-40003 5.1
CVE-2026-44597 3.7
CVE-2026-6278 N/A
CVE-2026-41484 5.3