179 matches found
Automattic: SSRF and local file disclosure in https://wordpress.com/media/videos/ via FFmpeg HLS processing
Summary FFmpeg is a video encoding software that appears to be used by wordpress.com for video processing for paid accounts. FFmpeg is known to process HLS playlists that may contain references to external files. I was able to fire this feature using GAB2 subtitle chunks inside an AVI file. After...
Fedora 23 : webkitgtk4 (2016-d957ffbac1)
This update addresses the following vulnerabilities : - CVE-2016-4622, CVE-2016-4624, CVE-2016-4591, CVE-2016-4590 Additional fixes : - Fix performance in accelerated compositing mode with the modesetting intel driver and DRI3 enabled. - Reduce the amount of file descriptors that the Web Process...
FFmpeg remote file stealing vulnerabilities – moving end of the safety analysis report-vulnerability warning-the black bar safety net
0x1 vulnerability of origin FFmpeg remote file stealing vulnerabilities original source is Foreign vulnerability of the platform,the last year has been in the CTF match is used. Official in January of this year released the fixed version and published the vulnerability number CVE-2 0 1 6-1 8 9...
The vulnerability of the FFmpeg multimedia library allows attackers to read arbitrary files or carry out attacks aimed at replacing the source code.
The vulnerability of the FFmpeg multimedia library lies in the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to perform attacks aimed at replacing the source material or reading arbitrary files using the Concat protocol in the HTTP Live Streaming HLS...
SeaWell Networks Spectrum - Multiple Vulnerabilities
Exploit for php platform in category web applications Exploit Title: SeaWell Networks Spectrum - Multiple Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: http://www.seawellnetworks.com/spectrum/ Versions Reported: Spectrum SDC 02.05.00, Build 02.05.00.0016 CVE-ID: CVE-2015-8282...
CVE-2016-1897
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file...
Xxe
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file...
CVE-2016-1897
CVE-2016-1897 affects FFmpeg 2.x (and Libav) via the HTTP Live Streaming (HLS) M3U8 concat protocol, where a crafted playlist can cause the client to perform an external HTTP request whose URL contains the first line of a local file. This enables cross-origin attacks and potential local-file disc...
CVE-2016-1898
CVE-2016-1898 affects FFmpeg 2.x (and Libav fork) where processing an HLS M3U8 playlist can cause an external HTTP request whose URL contains a line from a local file, enabling cross-origin information disclosure. The vulnerability is triggered by the subfile protocol in M3U8 (and the related con...
CVE-2016-1898
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file...
CVE-2016-1897
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file...
UBUNTU-CVE-2016-1898
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file...
Adobe Flash HLS Stack Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of HTTP...
openSUSE Security Update : ffmpeg (openSUSE-2015-821)
The ffmpeg package was updated to version 2.8.2 to fix the following security and non security issues : - CVE-2015-8216: Fixed the ljpegdecodeyuvscan function in libavcodec/mjpegdec.c which could cause a denial of service out-of-bounds array access bnc955346. - CVE-2015-8217: Fixed the...
Adobe Flash HLS Playlist Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processin...
Flussonic Media Server 4.1.25 < 4.3.3 - Arbitrary File Disclosure
Document Title: ============ Flussonic Media Server 4.3.3 Multiple Vulnerabilities Release Date: =========== June 29, 2014 Product & Service Introduction: ======================== Flussonic is a mutli-protocol streaming server with support for many protocols, including HDS, HLS, RTMP, RTSP, HTTP,...
WowzaMediaServer SecureToken bypass (and worse)
Product: Wowza Media Server URL: http://www.wowza.com/ Description: WMS is a quite popular RTMP/HLS/HDS/RTSP streaming server Issue: By default all installations of WMS use four modules in their application's config file: base, properties, logging, flvplayback. I've found out that the properties...
WowzaMediaServer StorageDir escape (regression)
Product: Wowza Media Server URL: http://www.wowza.com/ Description: WMS is a quite popular RTMP/HLS/HDS/RTSP streaming server Issue: In early 2009 I reported problem with processing of requests with relative paths. The issue surfaced again. In a nutshell, you can escape Applications StorageDir...
WowzaMediaServer StorageDir Constraint Bypass
Product: Wowza Media Server URL: http://www.wowza.com/ Description: WMS is a quite popular RTMP/HLS/HDS/RTSP streaming server Issue: In early 2009 I reported problem with processing of requests with relative paths. The issue surfaced again. In a nutshell, you can escape Applications StorageDir...