| Package | Affected versions | Patched versions |
|---|---|---|
| ffmpeg | ≥ 3.0, < 3.1.9≥ 3.2, < 3.2.6≥ 3.3, < 3.3.2< 2.8.12 | 3.1.93.2.63.3.22.8.12 |
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free