CVE-2019-8378: High severity bento4 vulnerability
Published Feb 17, 2019
·Updated
An issue was discovered in Bento4 1.5.1-628. A heap-based buffer over-read exists in AP4BitStream::ReadBytes() in Codecs/Ap4BitStream.cpp, a similar issue to CVE-2017-14645. It can be triggered by sending a crafted file to the aac2mp4 binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Affected Software
1 affected component
Axiosys Bento4=1.5.1-628
Event History
Feb 17, 2019
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Data Sourced
via NVD·02:29 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2019-8378?
CVE-2019-8378 has a severity rating of moderate due to its potential to cause Denial of Service.
2
How do I fix CVE-2019-8378?
To fix CVE-2019-8378, upgrade Bento4 to version 1.5.1-629 or later.
3
What type of vulnerability is CVE-2019-8378?
CVE-2019-8378 is a heap-based buffer over-read vulnerability.
4
What software is affected by CVE-2019-8378?
CVE-2019-8378 affects Bento4 version 1.5.1-628.
5
How can CVE-2019-8378 be exploited?
CVE-2019-8378 can be exploited by sending a specially crafted file to the aac2mp4 binary.