Cuanduoo

**Name of the Vulnerable Software and Affected Versions** GPAC version 0.8.0 **Description** An issue was discovered in the function `gf m2ts stream process pmt()` in `media tools/m2ts mux.c`, which leads to a NULL pointer dereference. **Recommendations** For GPAC version 0.8.0, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Ming (aka libming) version 0.4.8 **Description** The issue is a heap-based buffer over-read in the function `decompile SWITCH()` located in `decompile.c`. **Recommendations** For Ming (aka libming) version 0.4.8, consider avoiding the use of the `decompile SWITCH()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GPAC version 0.8.0 **Description** A NULL pointer dereference issue was found in the `gf isom get media data size()` function, located in the `isomedia/isom read.c` file. **Recommendations** For GPAC version 0.8.0, consider avoiding the use of the `gf isom get media data size()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** GoPro GPMF-parser version 1.2.3 **Description** The issue is related to a heap-based buffer over-read in the GetPayload function located in the GPMF mp4reader.c file. **Recommendations** For GoPro GPMF-parser version 1.2.3, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Bento4 version 1.5.1.0 **Description** A NULL pointer dereference issue was discovered in the `AP4 Descriptor::GetTag` function when called from `AP4 DecoderConfigDescriptor::GetDecoderSpecificInfoDescriptor` in Ap4DecoderConfigDescriptor.cpp, potentially leading to a crash or other unintended behavior. **Recommendations** For Bento4 version 1.5.1.0, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** libsixel version 1.8.4 **Description** A heap-based buffer overflow issue was found in the function `gif init frame` at `fromgif.c`. **Recommendations** For libsixel version 1.8.4, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Bento4 version 1.5.1.0 **Description** A NULL pointer dereference issue was discovered in the `AP4 Descriptor::GetTag` function when called from `AP4 EsDescriptor::GetDecoderConfigDescriptor` in Ap4EsDescriptor.cpp, specifically in the mp42ts component. **Recommendations** For Bento4 version 1.5.1.0, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** GoPro GPMF-parser version 1.2.3 **Description** The issue is related to a heap-based buffer over-read in the `GPMF Next` function located in `GPMF parser.c`. **Recommendations** For GoPro GPMF-parser version 1.2.3, consider applying a patch or fix that addresses the heap-based buffer over-read issue in the `GPMF Next` function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GoPro GPMF-parser version 1.2.3 **Description** The issue is related to a heap-based buffer over-read in the `GPMF seekToSamples` function, located in `GPMF-parse.c`, which is part of the "matching tags" feature. **Recommendations** For GoPro GPMF-parser version 1.2.3, consider disabling the "matching tags" feature as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Codedoc version 3.2 **Description** The issue is related to a stack-based buffer overflow in the `add variable` function in `codedoc.c`, specifically involving the `codedoc strlcpy` function. **Recommendations** For Codedoc version 3.2, consider restricting access to the `add variable` function in `codedoc.c` to minimize the risk of exploitation until a patch is available.