Mengyue Feng

**Name of the Vulnerable Software and Affected Versions** Axiomatic Bento4 (affected versions not specified) **Description** A problematic issue was found, affecting the `ParseCommandLine` function of the `Mp4Tag/Mp4Tag.cpp` file in the `mp4tag` component. This issue leads to denial of service and can be exploited remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Axiomatic Bento4 (affected versions not specified) **Description** A problematic issue has been found, affecting the `AP4 File::AP4 File` function of the `Mp42Hevc.cpp` file in the `mp42hevc` component. This issue leads to denial of service and can be initiated remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bento4 version 1.6.0-639 **Description** A memory leak was discovered in Bento4 via the AP4 SttsAtom::Create function in mp42hls. **Recommendations** For version 1.6.0-639, consider restricting the use of the AP4 SttsAtom::Create function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Bento4 versions through 1.6.0-639 **Description** A NULL pointer dereference issue occurs in the `AP4 File::ParseStream` function, located in `Core/Ap4File.cpp`, which is called from `AP4 File::AP4 File`. **Recommendations** For versions through 1.6.0-639, consider updating to a version that fixes this issue, as no specific mitigation measures are provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xpdf version 4.04 **Description** An issue was discovered that causes a crash in the `gfseek( IO FILE*, long, int)` function in the `goo/gfile.cc` file. **Recommendations** For Xpdf version 4.04, as a temporary workaround, consider disabling the `gfseek()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.