Zero-Day Vulnerability Discovered In FFmpeg Lets Attackers Steal Files Remotely

Posted by timothy on Thursday January 14, 2016 @10:31AM from the which-point-in-the-stack dept.

prisoninmate writes: A zero-day vulnerability in the FFmpeg open-source multimedia framework, which is currently used in numerous Linux kernel-based operating systems and software applications, also for the Mac OS X and Windows platforms, has been discovered recently by Russian programmer Maxim Andreev in the current stable builds of the software. It appears to let anyone with the necessary skills hack a computer to read local files on a remote machine and send them over the network using a specially crafted video file. Arch Linux devs already rebuilt their FFmpeg packages without the AppleHTTP and HLS demuxers.

1 of 72 comments (clear)

Min score:

Reason:

Sort:

Re: why so hung up about arch? by Anonymous Coward · 2016-01-14 10:56 · Score: 3, Insightful

Don't gentoo users choose their own build settings / features by default? What do you want the article to say? "Most gentoo users probably have the problem fixed by themselves already too but we don't really know?"