Hee-Won

**Name of the Vulnerable Software and Affected Versions** Aleksoid1978 MPC-BE versions prior to commit 4341cb3 **Description** An access violation occurs in the `BaseSplitterFile::Read()` function when processing a specially crafted MP4 file, which can lead to a Denial of Service (DoS). A Denial of Service is a condition where a system becomes unavailable to its intended users. **Recommendations** Update Aleksoid1978 MPC-BE to commit 4341cb3 or a later version.

**Name of the Vulnerable Software and Affected Versions** Bento4 version 1.6.0-640 **Description** The issue is related to an out-of-memory bug in the `AP4 DataBuffer::ReallocateBuffer()` function. **Recommendations** For Bento4 version 1.6.0-640, consider restricting the use of the `AP4 DataBuffer::ReallocateBuffer()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Bento4 version 1.6.0-640 **Description** The issue is an out-of-memory bug that occurs via the `AP4 UrlAtom::AP4 UrlAtom()` function. **Recommendations** For Bento4 version 1.6.0-640, consider disabling the `AP4 UrlAtom::AP4 UrlAtom()` function as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bento4 version 1.6.0-640 **Description** A NULL pointer dereference was discovered via the `AP4 DescriptorFinder::Test()` function. **Recommendations** For Bento4 version 1.6.0-640, as a temporary workaround, consider disabling the `AP4 DescriptorFinder::Test()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** SWFTools version 0.9.2 **Description** The issue allows attackers to trigger a large memory-allocation attempt via a crafted document, as demonstrated by pdf2swf. This occurs in the `png read chunk` function in lib/png.c. **Recommendations** For SWFTools version 0.9.2, consider disabling the `png read chunk` function in lib/png.c as a temporary workaround until a patch is available. Restrict access to the `pdf2swf` tool to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** imlib2 version 1.9.1 **Description** The issue is related to the mishandling of memory allocation in the function `init imlib fonts()`. **Recommendations** For imlib2 version 1.9.1, consider disabling the `init imlib fonts()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** imlib2 version 1.9.1 **Description** An issue in the `imlib load image with error return` function allows attackers to cause a heap buffer overflow via parsing a crafted image. **Recommendations** For imlib2 version 1.9.1, consider disabling the `imlib load image with error return` function until a patch is available to prevent heap buffer overflow attacks.

**Name of the Vulnerable Software and Affected Versions** imlib2 version 1.9.1 **Description** An issue in the imlib free image and decache function allows attackers to cause a heap buffer overflow via parsing a crafted image. **Recommendations** For imlib2 version 1.9.1, consider avoiding the use of the imlib free image and decache function until a patch is available. As a temporary workaround, restrict the parsing of crafted images to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bento4 version 1.6.0-640 **Description** The issue is related to a NULL pointer dereference in the `AP4 StszAtom::GetSampleSize()` function of the Bento4 library, which can lead to a denial of service. This function is part of the ISO-MP4 file reading and writing library. The exploitation of this issue may allow an attacker to cause a service disruption. **Recommendations** For Bento4 version 1.6.0-640, as a temporary workaround, consider disabling the `AP4 StszAtom::GetSampleSize()` function until a patch is available. However, since no specific fix is mentioned for this version, and given the nature of the issue, it is crucial to monitor for updates from the vendor that may address this problem. At the moment, there is no information about a newer version that contains a fix for this vulnerability.