Bento4 vulnerabilities

A heap-based buffer overflow was discovered in AP4_VisualSampleEntry::ReadFields in Bento4 version 1.5.0-617. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.

A heap-based buffer overflow was discovered in the AP4_HdlrAtom class in Bento4 1.5.0-617. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.

The AP4_VisualSampleEntry::ReadFields function in Bento4 1.5.0-617 has an error in the use of character data types, leading to a stack-based buffer underflow and out-of-bounds write. This may result in application crashes or other unspecified impacts.

A stack overflow vulnerability was found in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of Bento4 before version 1.8.9. Attackers can exploit this by providing a crafted MP4 file, causing a Denial of Service (DoS).

A stack overflow vulnerability in the AP4_StsdAtom::AP4_StsdAtom component of Bento4 before version 1.8.9 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

A floating point exception (divide-by-zero) vulnerability was discovered in Bento4 1.6.0-641 in the AP4_TfraAtom() function of Ap4TfraAtom.cpp. A remote attacker can exploit this flaw to cause a denial of service (DoS).

Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4encrypt.