Axiosys Bento4

Bento4 v1.5.1-628 contains a Memory leak on AP4_Movie::AP4_Movie, parsing tracks and added into m_Tracks list, but mp42aac

CVE-2024-24155 6.5 - Medium - February 29, 2024

Bento4 v1.5.1-628 contains a Memory leak on AP4_Movie::AP4_Movie, parsing tracks and added into m_Tracks list, but mp42aac cannot correctly delete when we got an no audio track found error. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted mp4 file.

Memory Leak

Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference

CVE-2024-25454 5.5 - Medium - February 09, 2024

Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_DescriptorFinder::Test() function.

NULL Pointer Dereference

Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference

CVE-2024-25453 5.5 - Medium - February 09, 2024

Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_StszAtom::GetSampleSize() function.

NULL Pointer Dereference

Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug

CVE-2024-25452 5.5 - Medium - February 09, 2024

Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_UrlAtom::AP4_UrlAtom() function.

Resource Exhaustion

Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug

CVE-2024-25451 6.5 - Medium - February 09, 2024

Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_DataBuffer::ReallocateBuffer() function.

Resource Exhaustion

Bento4 v1.6.0-639 was discovered to contain a segmentation violation

CVE-2023-38666 5.5 - Medium - August 22, 2023

Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4encrypt.

Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42aac component.

CVE-2023-29575 5.5 - Medium - April 21, 2023

Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42aac component.

Allocation of Resources Without Limits or Throttling

Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp4info component.

CVE-2023-29573 5.5 - Medium - April 13, 2023

Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp4info component.

Allocation of Resources Without Limits or Throttling

Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42avc component.

CVE-2023-29574 5.5 - Medium - April 12, 2023

Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42avc component.

Bento4 v1.6.0-639 was discovered to contain a segmentation violation

CVE-2023-29576 5.5 - Medium - April 11, 2023

Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_TrunAtom::SetDataOffset(int) function in Ap4TrunAtom.h.

Out-of-bounds Read

A vulnerability was found in Axiomatic Bento4 up to 1.6.0-639

CVE-2022-4584 8.8 - High - December 17, 2022

A vulnerability was found in Axiomatic Bento4 up to 1.6.0-639. It has been rated as critical. Affected by this issue is some unknown functionality of the component mp42aac. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-216170 is the identifier assigned to this vulnerability.

Heap-based Buffer Overflow

A vulnerability classified as critical was found in Axiomatic Bento4

CVE-2022-3974 8.8 - High - November 13, 2022

A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is the function AP4_StdcFileByteStream::ReadPartial of the file Ap4StdCFileByteStream.cpp of the component mp4info. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213553 was assigned to this vulnerability.

Memory Corruption

A vulnerability was found in Axiomatic Bento4

CVE-2022-3810 6.5 - Medium - November 02, 2022

A vulnerability was found in Axiomatic Bento4. It has been classified as problematic. This affects the function AP4_File::AP4_File of the file Mp42Hevc.cpp of the component mp42hevc. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212667.

Improper Resource Shutdown or Release

A vulnerability was found in Axiomatic Bento4 and classified as problematic

CVE-2022-3809 6.5 - Medium - November 02, 2022

A vulnerability was found in Axiomatic Bento4 and classified as problematic. Affected by this issue is the function ParseCommandLine of the file Mp4Tag/Mp4Tag.cpp of the component mp4tag. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212666 is the identifier assigned to this vulnerability.

Improper Resource Shutdown or Release

A vulnerability has been found in Axiomatic Bento4 and classified as problematic

CVE-2022-3817 6.5 - Medium - November 01, 2022

A vulnerability has been found in Axiomatic Bento4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component mp4mux. The manipulation leads to memory leak. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212683.

Improper Resource Shutdown or Release

A vulnerability, which was classified as problematic, was found in Axiomatic Bento4

CVE-2022-3816 6.5 - Medium - November 01, 2022

A vulnerability, which was classified as problematic, was found in Axiomatic Bento4. Affected is an unknown function of the component mp4decrypt. The manipulation leads to memory leak. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212682 is the identifier assigned to this vulnerability.

Improper Resource Shutdown or Release

A vulnerability, which was classified as problematic, has been found in Axiomatic Bento4

CVE-2022-3815 6.5 - Medium - November 01, 2022

A vulnerability, which was classified as problematic, has been found in Axiomatic Bento4. This issue affects some unknown processing of the component mp4decrypt. The manipulation leads to memory leak. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212681 was assigned to this vulnerability.

Improper Resource Shutdown or Release

A vulnerability classified as problematic was found in Axiomatic Bento4

CVE-2022-3814 6.5 - Medium - November 01, 2022

A vulnerability classified as problematic was found in Axiomatic Bento4. This vulnerability affects unknown code of the component mp4decrypt. The manipulation leads to memory leak. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212680.

Improper Resource Shutdown or Release

A vulnerability classified as problematic has been found in Axiomatic Bento4

CVE-2022-3813 6.5 - Medium - November 01, 2022

A vulnerability classified as problematic has been found in Axiomatic Bento4. This affects an unknown part of the component mp4edit. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212679.

Improper Resource Shutdown or Release

A vulnerability was found in Axiomatic Bento4

CVE-2022-3812 6.5 - Medium - November 01, 2022

A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is the function AP4_ContainerAtom::AP4_ContainerAtom of the component mp4encrypt. The manipulation leads to memory leak. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212678 is the identifier assigned to this vulnerability.

Memory Leak

A vulnerability was found in Axiomatic Bento4

CVE-2022-3807 6.5 - Medium - November 01, 2022

A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Incomplete Fix CVE-2019-13238. The manipulation leads to resource consumption. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212660.

Unchecked Return Value

A vulnerability, which was classified as critical, has been found in Axiomatic Bento4

CVE-2022-3785 7.8 - High - October 31, 2022

A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. Affected by this issue is the function AP4_DataBuffer::SetDataSize of the component Avcinfo. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212564.

Memory Corruption

A vulnerability classified as critical was found in Axiomatic Bento4 5e7bb34

CVE-2022-3784 7.8 - High - October 31, 2022

A vulnerability classified as critical was found in Axiomatic Bento4 5e7bb34. Affected by this vulnerability is the function AP4_Mp4AudioDsiParser::ReadBits of the file Ap4Mp4AudioInfo.cpp of the component mp4hls. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212563.

Memory Corruption

A vulnerability was found in Axiomatic Bento4

CVE-2022-3670 7.8 - High - October 26, 2022

A vulnerability was found in Axiomatic Bento4. It has been classified as critical. Affected is the function WriteSample of the component mp42hevc. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212010 is the identifier assigned to this vulnerability.

Memory Corruption

A vulnerability was found in Axiomatic Bento4 and classified as problematic

CVE-2022-3669 5.5 - Medium - October 26, 2022

A vulnerability was found in Axiomatic Bento4 and classified as problematic. This issue affects the function AP4_AvccAtom::Create of the component mp4edit. The manipulation leads to memory leak. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212009 was assigned to this vulnerability.

Memory Leak

A vulnerability has been found in Axiomatic Bento4 and classified as problematic

CVE-2022-3668 5.5 - Medium - October 26, 2022

A vulnerability has been found in Axiomatic Bento4 and classified as problematic. This vulnerability affects the function AP4_AtomFactory::CreateAtomFromStream of the component mp4edit. The manipulation leads to memory leak. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212008.

Memory Leak

A vulnerability classified as critical was found in Axiomatic Bento4

CVE-2022-3665 7.8 - High - October 26, 2022

A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is an unknown functionality of the file AvcInfo.cpp of the component avcinfo. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212005 was assigned to this vulnerability.

Memory Corruption

A vulnerability, which was classified as critical, was found in Axiomatic Bento4

CVE-2022-3667 7.5 - High - October 26, 2022

A vulnerability, which was classified as critical, was found in Axiomatic Bento4. This affects the function AP4_MemoryByteStream::WritePartial of the file Ap4ByteStream.cpp of the component mp42aac. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212007.

Memory Corruption

A vulnerability, which was classified as critical, has been found in Axiomatic Bento4

CVE-2022-3666 7.8 - High - October 26, 2022

A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. Affected by this issue is the function AP4_LinearReader::Advance of the file Ap4LinearReader.cpp of the component mp42ts. The manipulation leads to use after free. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212006 is the identifier assigned to this vulnerability.

Dangling pointer

A vulnerability classified as critical has been found in Axiomatic Bento4

CVE-2022-3664 7.8 - High - October 26, 2022

A vulnerability classified as critical has been found in Axiomatic Bento4. Affected is the function AP4_BitStream::WriteBytes of the file Ap4BitStream.cpp of the component avcinfo. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212004.

Memory Corruption

A vulnerability was found in Axiomatic Bento4

CVE-2022-3663 5.5 - Medium - October 26, 2022

A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. This issue affects the function AP4_StsdAtom of the file Ap4StsdAtom.cpp of the component MP4fragment. The manipulation leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212003.

NULL Pointer Dereference

A vulnerability was found in Axiomatic Bento4

CVE-2022-3662 7.8 - High - October 26, 2022

A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of the component mp42hls. The manipulation leads to use after free. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212002 is the identifier assigned to this vulnerability.

Dangling pointer

Bento4 v1.6.0-639 has a memory allocation issue

CVE-2022-40885 5.5 - Medium - October 19, 2022

Bento4 v1.6.0-639 has a memory allocation issue that can cause denial of service.

Allocation of Resources Without Limits or Throttling

Bento4 1.6.0 has memory leaks

CVE-2022-40884 5.5 - Medium - October 19, 2022

Bento4 1.6.0 has memory leaks via the mp4fragment.

Memory Leak

Bento4 v1.6.0-639 was discovered to contain a heap overflow

CVE-2022-43038 6.5 - Medium - October 19, 2022

Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadCache() function in mp42ts.

Memory Corruption

An issue was discovered in Bento4 1.6.0-639

CVE-2022-43033 6.5 - Medium - October 19, 2022

An issue was discovered in Bento4 1.6.0-639. There is a bad free in the component AP4_HdlrAtom::~AP4_HdlrAtom() which allows attackers to cause a Denial of Service (DoS) via a crafted input.

Dangling pointer

An issue was discovered in Bento4 v1.6.0-639

CVE-2022-43032 6.5 - Medium - October 19, 2022

An issue was discovered in Bento4 v1.6.0-639. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescriptorFactory.cpp, as demonstrated by mp42aac.

Memory Leak

An issue was discovered in Bento4 1.6.0-639

CVE-2022-43037 6.5 - Medium - October 19, 2022

An issue was discovered in Bento4 1.6.0-639. There is a memory leak in the function AP4_File::ParseStream in /Core/Ap4File.cpp.

Memory Leak

An issue was discovered in Bento4 v1.6.0-639

CVE-2022-43035 6.5 - Medium - October 19, 2022

An issue was discovered in Bento4 v1.6.0-639. There is a heap-buffer-overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading to a Denial of Service (DoS), as demonstrated by mp42aac.

Memory Corruption

An issue was discovered in Bento4 v1.6.0-639

CVE-2022-43034 6.5 - Medium - October 19, 2022

An issue was discovered in Bento4 v1.6.0-639. There is a heap buffer overflow vulnerability in the AP4_BitReader::SkipBits(unsigned int) function in mp42ts.

Memory Corruption

Bento4 v1.6.0-639 was discovered to contain a heap overflow

CVE-2022-41430 8.8 - High - October 03, 2022

Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadBit function in mp4mux.

Memory Corruption

Bento4 v1.6.0-639 was discovered to contain a heap overflow

CVE-2022-41429 8.8 - High - October 03, 2022

Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_Atom::TypeFromString function in mp4tag.

Memory Corruption

Bento4 v1.6.0-639 was discovered to contain a heap overflow

CVE-2022-41428 8.8 - High - October 03, 2022

Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadBits function in mp4mux.

Memory Corruption

Bento4 v1.6.0-639 was discovered to contain a memory leak in the AP4_AvcFrameParser::Feed function in mp4mux.

CVE-2022-41427 6.5 - Medium - October 03, 2022

Bento4 v1.6.0-639 was discovered to contain a memory leak in the AP4_AvcFrameParser::Feed function in mp4mux.

Memory Leak

Bento4 v1.6.0-639 was discovered to contain a memory leak

CVE-2022-41426 6.5 - Medium - October 03, 2022

Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_AtomFactory::CreateAtomFromStream function in mp4split.

Memory Leak

Bento4 v1.6.0-639 was discovered to contain a segmentation violation

CVE-2022-41425 6.5 - Medium - October 03, 2022

Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4decrypt.

Bento4 v1.6.0-639 was discovered to contain a memory leak

CVE-2022-41424 6.5 - Medium - October 03, 2022

Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_SttsAtom::Create function in mp42hls.

Memory Leak

Bento4 v1.6.0-639 was discovered to contain a segmentation violation in the mp4fragment component.

CVE-2022-41423 6.5 - Medium - October 03, 2022

Bento4 v1.6.0-639 was discovered to contain a segmentation violation in the mp4fragment component.

Bento4 v1.6.0-639 was discovered to contain a memory leak

CVE-2022-41419 6.5 - Medium - October 03, 2022

Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_Processor::Process function in the mp4encrypt binary.

Memory Leak

An issue was discovered in Bento4 1.6.0-639

CVE-2022-41847 5.5 - Medium - September 30, 2022

An issue was discovered in Bento4 1.6.0-639. A memory leak exists in AP4_StdcFileByteStream::Create(AP4_FileByteStream*, char const*, AP4_FileByteStream::Mode, AP4_ByteStream*&) in System/StdC/Ap4StdCFileByteStream.cpp.

Memory Leak

An issue was discovered in Bento4 1.6.0-639

CVE-2022-41846 5.5 - Medium - September 30, 2022

An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_DataBuffer::ReallocateBuffer in Core/Ap4DataBuffer.cpp.

Allocation of Resources Without Limits or Throttling

An issue was discovered in Bento4 1.6.0-639

CVE-2022-41845 5.5 - Medium - September 30, 2022

An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_Array<AP4_ElstEntry>::EnsureCapacity in Core/Ap4Array.h.

Allocation of Resources Without Limits or Throttling

An issue was discovered in Bento4 through 1.6.0-639

CVE-2022-41841 5.5 - Medium - September 30, 2022

An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_File::ParseStream in Core/Ap4File.cpp, which is called from AP4_File::AP4_File.

NULL Pointer Dereference

An issue was discovered in Bento4 through 1.6.0-639

CVE-2022-40775 5.5 - Medium - September 18, 2022

An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_StszAtom::WriteFields.

NULL Pointer Dereference

An issue was discovered in Bento4 through 1.6.0-639

CVE-2022-40774 5.5 - Medium - September 18, 2022

An issue was discovered in Bento4 through 1.6.0-639. There is a NULL pointer dereference in AP4_StszAtom::GetSampleSize.

NULL Pointer Dereference

An issue was discovered in Bento4 through 1.6.0-639

CVE-2022-40738 6.5 - Medium - September 15, 2022

An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_DescriptorListWriter::Action in Core/Ap4Descriptor.h, called from AP4_EsDescriptor::WriteFields and AP4_Expandable::Write.

NULL Pointer Dereference

An issue was discovered in Bento4 through 1.6.0-639

CVE-2022-40737 6.5 - Medium - September 15, 2022

An issue was discovered in Bento4 through 1.6.0-639. A buffer over-read exists in the function AP4_StdcFileByteStream::WritePartial located in System/StdC/Ap4StdCFileByteStream.cpp, called from AP4_ByteStream::Write and AP4_HdlrAtom::WriteFields.

Out-of-bounds Read

An issue was discovered in Bento4 1.6.0-639

CVE-2022-40736 6.5 - Medium - September 15, 2022

An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in AP4_CttsAtom::Create in Core/Ap4CttsAtom.cpp.

An memory leak issue was discovered in AP4_StdcFileByteStream::Create in mp42ts in Bento4 v1.6.0-639

CVE-2022-40439 6.5 - Medium - September 14, 2022

An memory leak issue was discovered in AP4_StdcFileByteStream::Create in mp42ts in Bento4 v1.6.0-639, allows attackers to cause a denial of service via a crafted file.

Memory Leak

Buffer overflow vulnerability in function AP4_MemoryByteStream::WritePartial in mp42aac in Bento4 v1.6.0-639

CVE-2022-40438 6.5 - Medium - September 14, 2022

Buffer overflow vulnerability in function AP4_MemoryByteStream::WritePartial in mp42aac in Bento4 v1.6.0-639, allows attackers to cause a denial of service via a crafted file.

Classic Buffer Overflow

An issue in AP4_SgpdAtom::AP4_SgpdAtom() of Bento4-1.6.0-639

CVE-2022-35165 5.5 - Medium - August 18, 2022

An issue in AP4_SgpdAtom::AP4_SgpdAtom() of Bento4-1.6.0-639 allows attackers to cause a Denial of Service (DoS) via a crafted mp4 input.

Infinite Loop

In Bento4 1.6.0-638

CVE-2021-40943 5.5 - Medium - June 28, 2022

In Bento4 1.6.0-638, there is a null pointer reference in the function AP4_DescriptorListInspector::Action function in Ap4Descriptor.h:124 , as demonstrated by GPAC. This can cause a denial of service (DOS).

NULL Pointer Dereference

In Bento4 1.6.0-638

CVE-2021-40941 7.5 - High - June 27, 2022

In Bento4 1.6.0-638, there is an allocator is out of memory in the function AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity in Ap4Array.h:172, as demonstrated by GPAC. This can cause a denial of service (DOS).

Allocation of Resources Without Limits or Throttling

An issue was discovered in Bento4 v1.2

CVE-2022-31287 5.5 - Medium - June 10, 2022

An issue was discovered in Bento4 v1.2. There is an allocation size request error in /Ap4RtpAtom.cpp.

Allocation of Resources Without Limits or Throttling

An issue was discovered in Bento4 1.2

CVE-2022-31285 5.5 - Medium - June 10, 2022

An issue was discovered in Bento4 1.2. The allocator is out of memory in /Source/C++/Core/Ap4Array.h.

Allocation of Resources Without Limits or Throttling

Bento4 MP4Dump v1.2 was discovered to contain a segmentation violation

CVE-2022-31282 5.5 - Medium - June 10, 2022

Bento4 MP4Dump v1.2 was discovered to contain a segmentation violation via an unknown address at /Source/C++/Core/Ap4DataBuffer.cpp:175.

Bento4 v1.6.0.0 was discovered to contain a segmentation fault

CVE-2022-29017 5.5 - Medium - May 16, 2022

Bento4 v1.6.0.0 was discovered to contain a segmentation fault via the component /x86_64/multiarch/strlen-avx2.S.

Improper Handling of Exceptional Conditions

Bento4 1.6.0-639 has a heap-based buffer over-read in the AP4_HvccAtom class

CVE-2022-27607 8.1 - High - March 21, 2022

Bento4 1.6.0-639 has a heap-based buffer over-read in the AP4_HvccAtom class, a different issue than CVE-2018-14531.

Out-of-bounds Read

An issue was discovered in Bento4 through v1.6.0-637

CVE-2021-32265 8.8 - High - September 20, 2021

An issue was discovered in Bento4 through v1.6.0-637. A global-buffer-overflow exists in the function AP4_MemoryByteStream::WritePartial() located in Ap4ByteStream.cpp. It allows an attacker to cause code execution or information disclosure.

Classic Buffer Overflow

The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0

CVE-2018-10790 7.5 - High - August 25, 2021

The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (application crash), related to a memory allocation failure, as demonstrated by mp2aac.

Allocation of Resources Without Limits or Throttling

A WRITE memory access in the AP4_NullTerminatedStringAtom::AP4_NullTerminatedStringAtom component of Bento4 version 06c39d9

CVE-2020-23334 7.5 - High - August 17, 2021

A WRITE memory access in the AP4_NullTerminatedStringAtom::AP4_NullTerminatedStringAtom component of Bento4 version 06c39d9 can lead to a segmentation fault.

Memory Corruption

A heap-based buffer overflow exists in the AP4_CttsAtom::AP4_CttsAtom component located in /Core/Ap4Utils.h of Bento4 version 06c39d9

CVE-2020-23333 7.5 - High - August 17, 2021

A heap-based buffer overflow exists in the AP4_CttsAtom::AP4_CttsAtom component located in /Core/Ap4Utils.h of Bento4 version 06c39d9. This can lead to a denial of service (DOS).

Memory Corruption

A heap-based buffer overflow exists in the AP4_StdcFileByteStream::ReadPartial component located in /StdC/Ap4StdCFileByteStream.cpp of Bento4 version 06c39d9

CVE-2020-23332 7.5 - High - August 17, 2021

A heap-based buffer overflow exists in the AP4_StdcFileByteStream::ReadPartial component located in /StdC/Ap4StdCFileByteStream.cpp of Bento4 version 06c39d9. This issue can lead to a denial of service (DOS).

Memory Corruption

An issue was discovered in Bento4 version 06c39d9

CVE-2020-23331 7.5 - High - August 17, 2021

An issue was discovered in Bento4 version 06c39d9. A NULL pointer dereference exists in the AP4_DescriptorListWriter::Action component located in /Core/Ap4Descriptor.h. It allows an attacker to cause a denial of service (DOS).

NULL Pointer Dereference

An issue was discovered in Bento4 version 06c39d9

CVE-2020-23330 7.5 - High - August 17, 2021

An issue was discovered in Bento4 version 06c39d9. A NULL pointer dereference exists in the AP4_Stz2Atom::GetSampleSize component located in /Core/Ap4Stz2Atom.cpp. It allows an attacker to cause a denial of service (DOS).

NULL Pointer Dereference

An issue was discovered in Bento4 v1.5.1.0

CVE-2020-21066 6.5 - Medium - August 13, 2021

An issue was discovered in Bento4 v1.5.1.0. There is a heap-buffer-overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading to a denial of service (program crash), as demonstrated by mp42aac.

Memory Corruption

An issue was discovered in Bento4 through v1.6.0-636

CVE-2021-35306 6.5 - Medium - August 05, 2021

An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the function AP4_StszAtom::WriteFields located in Ap4StszAtom.cpp. It allows an attacker to cause a denial of service (DOS).

NULL Pointer Dereference

An issue was discovered in Bento4 through v1.6.0-636

CVE-2021-35307 6.5 - Medium - August 05, 2021

An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the AP4_DescriptorFinder::Test component located in /Core/Ap4Descriptor.h. It allows an attacker to cause a denial of service (DOS).

NULL Pointer Dereference

A heap buffer overflow vulnerability in Ap4TrunAtom.cpp of Bento 1.5.1-628 may lead to an out-of-bounds write while running mp42aac

CVE-2020-19721 6.5 - Medium - July 13, 2021

A heap buffer overflow vulnerability in Ap4TrunAtom.cpp of Bento 1.5.1-628 may lead to an out-of-bounds write while running mp42aac, leading to system crashes and a denial of service (DOS).

Memory Corruption

An unhandled memory allocation failure in Core/AP4IkmsAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference

CVE-2020-19720 6.5 - Medium - July 13, 2021

An unhandled memory allocation failure in Core/AP4IkmsAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS).

NULL Pointer Dereference

An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a direct copy to NULL pointer dereference

CVE-2020-19722 6.5 - Medium - July 13, 2021

An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a direct copy to NULL pointer dereference, leading to a denial of service (DOS).

NULL Pointer Dereference

A buffer overflow vulnerability in Ap4ElstAtom.cpp of Bento 1.5.1-628 leads to a denial of service (DOS).

CVE-2020-19719 6.5 - Medium - July 13, 2021

A buffer overflow vulnerability in Ap4ElstAtom.cpp of Bento 1.5.1-628 leads to a denial of service (DOS).

Classic Buffer Overflow

An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference

CVE-2020-19718 6.5 - Medium - July 13, 2021

An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS).

NULL Pointer Dereference

An unhandled memory allocation failure in Core/Ap48bdlAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference

CVE-2020-19717 6.5 - Medium - July 13, 2021

An unhandled memory allocation failure in Core/Ap48bdlAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS).

NULL Pointer Dereference

An issue was discovered in Bento4 through v1.6.0-637

CVE-2020-23912 5.5 - Medium - April 21, 2021

An issue was discovered in Bento4 through v1.6.0-637. A NULL pointer dereference exists in the function AP4_StszAtom::GetSampleSize() located in Ap4StszAtom.cpp. It allows an attacker to cause Denial of Service.

NULL Pointer Dereference

An issue was discovered in Bento4 1.5.1.0

CVE-2019-20090 7.8 - High - December 30, 2019

An issue was discovered in Bento4 1.5.1.0. There is a use-after-free in AP4_Sample::GetOffset in Core/Ap4Sample.h when called from Ap4LinearReader.cpp.

Dangling pointer

An issue was discovered in Bento4 1.5.1.0

CVE-2019-20091 5.5 - Medium - December 30, 2019

An issue was discovered in Bento4 1.5.1.0. There is a NULL pointer dereference in AP4_Descriptor::GetTag in mp42ts when called from AP4_DecoderConfigDescriptor::GetDecoderSpecificInfoDescriptor in Ap4DecoderConfigDescriptor.cpp.

NULL Pointer Dereference

An issue was discovered in Bento4 1.5.1.0

CVE-2019-20092 5.5 - Medium - December 30, 2019

An issue was discovered in Bento4 1.5.1.0. There is a NULL pointer dereference in AP4_Descriptor::GetTag in mp42ts when called from AP4_EsDescriptor::GetDecoderConfigDescriptor in Ap4EsDescriptor.cpp.

NULL Pointer Dereference

An issue was discovered in Bento4 1.5.1.0

CVE-2019-17528 7.5 - High - October 12, 2019

An issue was discovered in Bento4 1.5.1.0. There is a SEGV in the function AP4_TfhdAtom::SetDefaultSampleSize at Core/Ap4TfhdAtom.h when called from AP4_Processor::ProcessFragments in Core/Ap4Processor.cpp.

An issue was discovered in Bento4 1.5.1.0

CVE-2019-17529 7.8 - High - October 12, 2019

An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in AP4_CencSampleEncryption::DoInspectFields in Core/Ap4CommonEncryption.cpp when called from AP4_Atom::Inspect in Core/Ap4Atom.cpp.

Out-of-bounds Read

An issue was discovered in Bento4 1.5.1.0

CVE-2019-17530 7.8 - High - October 12, 2019

An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in AP4_PrintInspector::AddField in Core/Ap4Atom.cpp when called from AP4_CencSampleEncryption::DoInspectFields in Core/Ap4CommonEncryption.cpp, when called from AP4_Atom::Inspect in Core/Ap4Atom.cpp.

Out-of-bounds Read

Bento4 1.5.1.0 has a NULL pointer dereference in AP4_DescriptorListInspector::Action in Core/Ap4Descriptor.h

CVE-2019-17452 6.5 - Medium - October 10, 2019

Bento4 1.5.1.0 has a NULL pointer dereference in AP4_DescriptorListInspector::Action in Core/Ap4Descriptor.h, related to AP4_IodsAtom::InspectFields in Core/Ap4IodsAtom.cpp, as demonstrated by mp4dump.

NULL Pointer Dereference

Bento4 1.5.1.0 has a NULL pointer dereference in AP4_DescriptorListWriter::Action in Core/Ap4Descriptor.h

CVE-2019-17453 6.5 - Medium - October 10, 2019

Bento4 1.5.1.0 has a NULL pointer dereference in AP4_DescriptorListWriter::Action in Core/Ap4Descriptor.h, related to AP4_IodsAtom::WriteFields in Core/Ap4IodsAtom.cpp, as demonstrated by mp4encrypt or mp4compact.

NULL Pointer Dereference

Bento4 1.5.1.0 has a NULL pointer dereference in AP4_Descriptor::GetTag in Core/Ap4Descriptor.h

CVE-2019-17454 6.5 - Medium - October 10, 2019

Bento4 1.5.1.0 has a NULL pointer dereference in AP4_Descriptor::GetTag in Core/Ap4Descriptor.h, related to AP4_StsdAtom::GetSampleDescription in Core/Ap4StsdAtom.cpp, as demonstrated by mp4info.

NULL Pointer Dereference

Bento4 1.5.1-628 has a NULL pointer dereference in AP4_ByteStream::ReadUI32 in Core/Ap4ByteStream.cpp when called

CVE-2019-16349 5.5 - Medium - September 16, 2019

Bento4 1.5.1-628 has a NULL pointer dereference in AP4_ByteStream::ReadUI32 in Core/Ap4ByteStream.cpp when called from the AP4_TrunAtom class.

NULL Pointer Dereference

An issue was discovered in Bento4 1.5.1.0

CVE-2019-15047 8.8 - High - August 14, 2019

An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the function AP4_BitReader::SkipBits at Core/Ap4Utils.cpp.

Out-of-bounds Read

An issue was discovered in Bento4 1.5.1.0

CVE-2019-15048 8.8 - High - August 14, 2019

An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer overflow in the AP4_RtpAtom class at Core/Ap4RtpAtom.cpp.

Memory Corruption

An issue was discovered in Bento4 1.5.1.0

CVE-2019-15049 8.8 - High - August 14, 2019

An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_Dec3Atom class at Core/Ap4Dec3Atom.cpp.

Out-of-bounds Read

An issue was discovered in Bento4 1.5.1.0

CVE-2019-15050 8.8 - High - August 14, 2019

An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_AvccAtom class at Core/Ap4AvccAtom.cpp.

Out-of-bounds Read

In Bento4 1.5.1-627, AP4_DataBuffer::SetDataSize does not handle reallocation failures, leading to a memory copy into a NULL pointer

CVE-2019-13959 6.5 - Medium - July 18, 2019

In Bento4 1.5.1-627, AP4_DataBuffer::SetDataSize does not handle reallocation failures, leading to a memory copy into a NULL pointer. This is different from CVE-2018-20186.

NULL Pointer Dereference