CVE-2019-17452

Name of the Vulnerable Software and Affected Versions Bento4 version 1.5.1.0

Description The issue is related to a NULL pointer dereference in the AP4 DescriptorListInspector::Action function in Core/Ap4Descriptor.h, which is connected to the AP4 IodsAtom::InspectFields function in Core/Ap4IodsAtom.cpp. This can be demonstrated using mp4dump.

Recommendations For Bento4 version 1.5.1.0, consider restricting access to the AP4 DescriptorListInspector::Action function until a patch is available. As a temporary workaround, avoid using the AP4 IodsAtom::InspectFields function in Core/Ap4IodsAtom.cpp to minimize the risk of exploitation.