Impact of ffmpeg vulnerability?

[doug.dimick 13]

Is Emby impacted by the recently announced ffmpeg remote file access vulnerability?

[Luke 42078]

We're not using concat unless you're transcoding folder rips and very few people are doing that.

[doug.dimick 13]

Perhaps I'm misunderstanding the vulnerability, but I believe the concat element would be included in a video file modified by the attacker, which would then be downloaded by the victim, and the vulnerability would be realized as soon as ffmpeg read the file for any reason.

 

http://seclists.org/oss-sec/2016/q1/85

[Luke 42078]

no, it's with the concat protocol which we're not using.

[overClocked! 65]

We're not using concat unless you're transcoding folder rips and very few people are doing that.

 

Let me read about this, then. Got lots of DVD folder rips still.

 

 

Sent from my iPhone using Tapatalk

Edited January 16, 2016 by overClocked!