CVE-2021-40941

Published: Jun 27, 2022Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Bento4 1.6.0-638, there is an allocator is out of memory in the function AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity in Ap4Array.h:172, as demonstrated by GPAC. This can cause a denial of service (DOS).

Affected (1)

Products: Axiosys: Bento4

Axiosys

1 product

Bento4

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Axiosys Bento4	Version 1.6.0-638

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (2)

https://github.com/axiomatic-systems/Bento4/issues/644

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/axiomatic-systems/Bento4/issues/644

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.