Slackware Linux update for MPlayer

Published: 2016-02-04 | Updated: 2017-05-06

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2016-1897 CVE-2016-1898
CWE-ID	CWE-200
Exploitation vector	Local
Public exploit	N/A
Vulnerable software	Slackware Linux Operating systems & Components / Operating system
Vendor	Slackware

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU32353

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-1897

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to gain access to sensitive information.

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.

Mitigation

Update the affected package MPlayer.

Vulnerable software versions

Slackware Linux: 13.0 - 14.1

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.529036

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU32354