CVE-2019-17454

Name of the Vulnerable Software and Affected Versions Bento4 version 1.5.1.0

Description The issue is related to a NULL pointer dereference in the AP4 Descriptor::GetTag function in Core/Ap4Descriptor.h, which is connected to the AP4 StsdAtom::GetSampleDescription function in Core/Ap4StsdAtom.cpp. This has been demonstrated using the mp4info tool.

Recommendations For Bento4 version 1.5.1.0, consider applying a patch or fix that addresses the NULL pointer dereference issue in the AP4 Descriptor::GetTag function. As a temporary workaround, consider restricting access to the AP4 Descriptor::GetTag function until a patch is available.