mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdl_hook.lua. For example, an av://lavfi:ladspa=file= URL signifies that the product should call dlopen on a shared object file located at an arbitrary local pathname. The issue exists because the product does not consider that youtube-dl can provide a potentially unsafe URL.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it     reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a     protocol whitelist in player/lua/ytdl_hook.lua. For example, an av://lavfi:ladspa=file= URL signifies that     the product should call dlopen on a shared object file located at an arbitrary local pathname. The issue     exists because the product does not consider that youtube-dl can provide a potentially unsafe URL.
    (CVE-2018-6360)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it
    reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a
    protocol whitelist in player/lua/ytdl_hook.lua. For example, an av://lavfi:ladspa=file= URL signifies that
    the product should call dlopen on a shared object file located at an arbitrary local pathname. The issue
    exists because the product does not consider that youtube-dl can provide a potentially unsafe URL.
    (CVE-2018-6360)

The remote host is affected by the vulnerability described in GLSA-201805-05 (mpv: Remote code execution)

    A vulnerability was discovered in mpv with the handling of HTML       documents containing VIDEO elements. Additionally, mpv accepts arbitrary       URLs in a src attribute without a protocol whitelist in       player/lua/ytdl_hook.lua.
  Impact :

    A remote attacker, by enticing the user to visit a specially crafted web       site, could execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

This update for mpv fixes the following issues :

MPV was updated to version 0.27.2

Security issues fixed :

  - CVE-2018-6360: Additional fix for where mpv allowed     remote attackers to execute arbitrary code via a crafted     website, because it read HTML documents containing VIDEO     elements, and accepts arbitrary URLs in a src attribute     without a protocol whitelist in     player/lua/ytdl_hook.lua. For example, an     av://lavfi:ladspa=file= URL signifies that the product     should call dlopen on a shared object file located at an     arbitrary local pathname. The issue exists because the     product does not consider that youtube-dl can provide a     potentially unsafe URL. (boo#1077894)

Fixes and minor enhancements :

  - ytdl_hook: whitelist subtitle URLs as well (#5456)

MPV was updated to version 0.27.1

Security issues fixed :

  - CVE-2018-6360: mpv allowed remote attackers to execute     arbitrary code via a crafted website, because it read     HTML documents containing VIDEO elements, and accepts     arbitrary URLs in a src attribute without a protocol     whitelist in player/lua/ytdl_hook.lua. For example, an     av://lavfi:ladspa=file= URL signifies that the product     should call dlopen on a shared object file located at an     arbitrary local pathname. The issue exists because the     product does not consider that youtube-dl can provide a     potentially unsafe URL. (boo#1077894)

Fixes and minor enhancements :

  - ytdl_hook: whitelist protocols from urls retrieved from     youtube-dl (#5456)

Version 0.27.0 :

Added features :

  - libmpv: options: add a thread-safe way to notify option     updates

  - vd_lavc/vo_opengl: support embedded ICC profiles

  - vo: rendering API abstraction for future non-GL video     outputs

  - vo_opengl: add a gamut warning feature to highlight     out-of-gamut colors (--gamut-warning)

  - vo_opengl: add direct rendering support (--vd-lavc-dr)

  - vo_opengl: implement (faster) compute shader based EWA     kernel

  - vo_opengl: implement HLG OOTF inverse

  - vo_opengl: support HDR peak detection     (--hdr-compute-peak)

  - vo_opengl: support float input pixel formats

  - vo_opengl: support loading custom user textures (#4586)

  - vo_opengl: support user compute shaders Removed features :

  - Remove video equalizer handling from vo_direct3d,     vo_sdl, vo_vaapi, and vo_xv (GPL, not worth the effort     to support legacy VOs) Added options and commands :

  - player: add --track-auto-selection option Changed     options and commands :

  - input: use mnemonic names for mouse buttons, same as Qt:
    https://doc.qt.io/qt-5/qt.html#MouseButton-enum

  - options: change --loop semantics

  - player: make --lavfi-complex changeable at runtime

  - vf_eq: remove this filter (GPL; uses libavfilter&rsquo;s     eq filter now, with changed semantics)

  - video: change --deinterlace behavior

  - vo_opengl: generalize HDR tone mapping to gamut mapping,

    --hdr-tone-mapping &rarr; --tone-mapping Removed options     and commands :

  - --field-dominance (GPL-only author, no chance of     relicensing)

  - input: drop deprecated 'osd' command

  - options: drop --video-aspect-method=hybrid (GPL-only)     Fixes and minor enhancements :

  - TOOLS/autocrop.lua: fix cropdetect black limit for     10-bit videos

  - TOOLS/lua/autodeint: update to lavfi-bridge

  - TOOLS/lua/status-line: improve and update

  - af_lavrresample: don't call swr_set_compensation()     unless necessary (#4716)

  - ao_oss: fix period_size calculation (#4642)

  - ao_rsound: allow setting the host

  - audio: fix spdif mode

  - filter_kernels: correct spline64 kernel

  - options: fix --include (#4673)

  - player: fix --end with large values (#4650)

  - player: fix confusion in audio resync code (#4688)

  - player: make refresh seeks slightly more robust (#4757)

  - player: readd smi subtitle extension (#4626)

  - vd_lavc: change auto-probe order to prefer cuda over     vdpau-copy

  - vd_lavc: fix device leak with copy-mode hwaccels (#4735)

  - vd_lavc: fix hwdec compatibility with yuvj420p formats

  - vd_lavc: fix mid-stream hwdec fallback

  - vf_vapoursynth: fix inverted sign and restore 10 bit     support (#4720)

  - video: increase --monitorpixelaspect range

  - vo_opengl: adjust the rules for linearization (#4631)

  - vo_opengl: scale deband-grain to the signal range

  - vo_opengl: tone map on the maximum signal component

  - x11: fix that window could be resized when using     embedding (#4784)

  - ytdl_hook: resolve relative paths when joining segment     urls (#4827)

  - ytdl_hook: support fragments with relative paths, fixes     segmented DASH

Version 0.26.0 :

  - Built-in V4L TV support is disabled by default.
    av://v4l2 can be used instead.

  - Support for C plugins is now enabled by default (#4491).

  - Many more parts of the player are now licensed under     LGPL, see Copyright file.

Added features :

  - csputils: implement sony s-gamut

  - vo_opengl: add new HDR tone mapping algorithm (mobius,     now default)

  - vo_opengl: hwdec_cuda: Support separate decode and     display devices

  - vo_opengl: implement sony s-log1 and s-log2 trc

  - vo_opengl: implement support for OOTFs and non-display     referred content

Removed features :

  - vf_dlopen: remove this filter

Added options and commands :

  - vo_opengl: add --tone-mapping-desaturate

  - vo_opengl: support tone-mapping-param for `clip`

  - ytdl_hook: add option to exclude URLs from being parsed

Changed options and commands :

  - allow setting profile option with libmpv

  - audio: move replaygain control to top-level options

  - external_files: parse ~ in --(sub,audio)-paths

  - options: change --sub-fix-timing default to no (#4484)

  - options: expose string list actions for --sub-file     option

  - options: slight cleanup of --sub-ass-style-override

  + signfs &rarr; scale

  + --sub-ass-style-override &rarr; --sub-ass-override

  - renamed the HDR TRCs `st2084` and `std-b67` to `pq` and     `hlg` respectively

  - replace vf_format's `peak` suboption by `sig-peak`,     which is relative to the reference white level instead     of in cd/m^2

  - the following options change to append-by-default (and     possibly separator): --script

  - video: change --video-aspect-method default value to     `container`

Deprecated options and commands :

  - m_option: deprecate multiple items for -add etc.

  - player: deprecate 'osd' command

  - --audio-file-paths => --audio-file-path

  - --sub-paths => --sub-file-path

  - --opengl-shaders => --opengl-shader

  - --sub-paths => --sub-file-paths

  - the following options are deprecated for setting via API :

  + 'script' (use 'scripts')

  + 'sub-file' (use 'sub-files')

  + 'audio-file' (use 'audio-files')

  + 'external-file' (use 'external-files') (the     compatibility hacks for this will be removed after this     release)

Removed options and commands :

  - chmap: remove misleading 'downmix' channel layout name     (#4545)

  - demux_lavf: remove --demuxer-lavf-cryptokey option     (#4579)

  - input.conf: drop TV/DVB bindings

  - options: remove remaining deprecated audio device     selection options

  + --alsa-device

  + --oss-device

  + --coreaudio-exclusive

  + --pulse-sink

  + --rsound-host/--rsound-port

  + --ao-sndio-device

  + --ao-wasapi-exclusive

  + --ao-wasapi-device

  - remove option --target-brightness

  - remove property 'video-params/nom-peak'

Fixes and minor enhancements :

  - TOOLS/lua/autoload.lua: actually sort files case     insensitive (#4398)

  - TOOLS/lua/autoload.lua: ignores all files starting with     '.'

  - ao_pulse: reorder format choice to prefer float and S32     over S16 as fallback format

  - command: add missing change notification for     playlist-shuffle (#4573)

  - demux_disc: fix bluray subtitle language retrieval     (#4611)

  - demux_mkv: fix alpha with vp9 + libvpx

  - demux_mkv: support FFmpeg A_MS/ACM extensions

  - ipc-unix: don&rsquo;t truncate the message on EAGAIN     (#4452)

  - ipc: raise json nesting limit (#4394)

  - mpv_identify: replace deprecated fps property (#4550)

  - options/path: fallback to USERPROFILE if HOME isn't set

  - player: close audio device on no audio track

  - player: fix potential segfault when playing dvd:// with     DVD disabled (#4393)

  - player: prevent seek position to jump around adjacent     keyframes, e.g. when dragging the OSC bar on short     videos (#4183)

  - vo_opengl: bump up SHADER_MAX_HOOKS and     MAX_TEXTURE_HOOKS to 64

  - vo_opengl: correct off-by-one in scale=oversample

  - vo_opengl: do not use vaapi-over-GLX (#4555)

  - vo_opengl: fall back to ordered dither instead of     blowing up (#4519)

  - vo_opengl: tone map in linear XYZ instead of RGB

  - x11: add 128x128 sized icon support

  - ytdl_hook: add a header to support geo-bypass

  - ytdl_hook: don't override start time set by saved state

  - ytdl_hook: don't override user-set start time

  - ytdl_hook: treat single-entry playlists as a single     video

  - gen: make output reproducible by ensuring stable output     of pairs() by wrapping it where it matters. (Closes #18)     version 3.3.15

  - Fix af/vf filter argument expansion (#15)

  - Remove some invalid suggestions for some options (#14)

  - Recognize all --profile-style options as such and     complete them version 3.3.14

  - Reflect changed --list-options output for --vf-add-style     options

  - Let mpv own /etc/mpv/scripts as a ghost dir so other     packages can create it and install scripts there.

mpv developers report :

mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted website, because it reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdl_hook.lua. For example, an av://lavfi:ladspa=file= URL signifies that the product should call dlopen on a shared object file located at an arbitrary local pathname.
The issue exists because the product does not consider that youtube-dl can provide a potentially unsafe URL.

It was discovered that mpv, a media player, was vulnerable to remote code execution attacks. An attacker could craft a malicious web page that, when used as an argument in mpv, could execute arbitrary code in the host of the mpv user.

ID	Name	Product	Family	Severity
254496	Linux Distros Unpatched Vulnerability : CVE-2018-6360	Nessus	Misc.	high
405636	Alpine: multiple mpv packages, umpv: security update to 0.27.0-r3	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405636	Alpine: multiple mpv packages, umpv: security update to 0.27.0-r3	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
405635	Alpine: multiple mpv packages, umpv: security update to 0.27.0-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405635	Alpine: multiple mpv packages, umpv: security update to 0.27.0-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400730	Alpine: multiple mpv packages: security update to 0.27.0-r2 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400730	Alpine: multiple mpv packages: security update to 0.27.0-r2 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
109806	GLSA-201805-05 : mpv: Remote code execution	Nessus	Gentoo Local Security Checks	high
106891	openSUSE Security Update : mpv (openSUSE-2018-173)	Nessus	SuSE Local Security Checks	high
106734	FreeBSD : mpv -- arbitrary code execution via crafted website (3ee6e521-0d32-11e8-99b0-d017c2987f9a)	Nessus	FreeBSD Local Security Checks	high
106660	Debian DSA-4105-1 : mpv - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-6360

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high