CVE-2019-17453

Name of the Vulnerable Software and Affected Versions Bento4 version 1.5.1.0

Description The issue is related to a NULL pointer dereference in the AP4 DescriptorListWriter::Action function in Core/Ap4Descriptor.h, which is connected to the AP4 IodsAtom::WriteFields function in Core/Ap4IodsAtom.cpp. This can be demonstrated using tools like mp4encrypt or mp4compact.

Recommendations For Bento4 version 1.5.1.0, consider avoiding the use of the AP4 DescriptorListWriter::Action function until a patch is available. As a temporary workaround, restrict access to the AP4 IodsAtom::WriteFields function to minimize the risk of exploitation.