SB2017092133 - Multiple vulnerabilities in axiomatic-systems Bento4

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017092133

SB2017092133 - Multiple vulnerabilities in axiomatic-systems Bento4

Published: September 21, 2017 Updated: August 8, 2020

Security Bulletin ID SB2017092133
Severity
High
Patch available
NO
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 30% Medium 70%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 secuirty vulnerabilities.


1) NULL pointer dereference (CVE-ID: CVE-2017-14638)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in Core/Ap4AtomFactory.cpp in Bento4 version 1.5.0-617 has missing NULL checks, leading to a NULL pointer dereference, segmentation fault, and application crash in AP4_Atom::SetType in Core/Ap4Atom.h. A remote attacker can perform a denial of service (DoS) attack.


2) Type Confusion (CVE-ID: CVE-2017-14639)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

AP4_VisualSampleEntry::ReadFields in Core/Ap4SampleEntry.cpp in Bento4 1.5.0-617 uses incorrect character data types, which causes a stack-based buffer underflow and out-of-bounds write, leading to denial of service (application crash) or possibly unspecified other impact.


3) NULL pointer dereference (CVE-ID: CVE-2017-14640)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in AP4_AtomSampleTable::GetSample in Core/Ap4AtomSampleTable.cpp in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service. A remote attacker can perform a denial of service (DoS) attack.


4) NULL pointer dereference (CVE-ID: CVE-2017-14641)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the AP4_DataAtom class in MetaData/Ap4MetaData.cpp in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service. A remote attacker can perform a denial of service (DoS) attack.


5) NULL pointer dereference (CVE-ID: CVE-2017-14642)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the AP4_HdlrAtom class in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash in AP4_StdcFileByteStream::ReadPartial in System/StdC/Ap4StdCFileByteStream.cpp, which leads to remote denial of service. A remote attacker can perform a denial of service (DoS) attack.


6) Out-of-bounds read (CVE-ID: CVE-2017-14643)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The AP4_HdlrAtom class in Core/Ap4HdlrAtom.cpp in Bento4 version 1.5.0-617 uses an incorrect character data type, leading to a heap-based buffer over-read and application crash in AP4_BytesToUInt32BE in Core/Ap4Utils.h.


7) Out-of-bounds write (CVE-ID: CVE-2017-14644)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A heap-based buffer overflow was discovered in the AP4_HdlrAtom class in Bento4 1.5.0-617. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.


8) Out-of-bounds read (CVE-ID: CVE-2017-14645)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A heap-based buffer over-read was discovered in AP4_BitStream::ReadBytes in Codecs/Ap4BitStream.cpp in Bento4 version 1.5.0-617. The vulnerability causes an application crash, which leads to remote denial of service.


9) Out-of-bounds read (CVE-ID: CVE-2017-14646)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The AP4_AvccAtom and AP4_HvccAtom classes in Bento4 version 1.5.0-617 do not properly validate data sizes, leading to a heap-based buffer over-read and application crash in AP4_DataBuffer::SetData in Core/Ap4DataBuffer.cpp.


10) Out-of-bounds write (CVE-ID: CVE-2017-14647)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A heap-based buffer overflow was discovered in AP4_VisualSampleEntry::ReadFields in Core/Ap4SampleEntry.cpp in Bento4 1.5.0-617. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References