Yin Li

**Name of the Vulnerable Software and Affected Versions** Bento4 version 1.6.0-639 **Description** An issue in Bento4 leads to excessive memory consumption in the `AP4 Array<AP4 ElstEntry>::EnsureCapacity` function, located in Core/Ap4Array.h. **Recommendations** For Bento4 version 1.6.0-639, consider applying a patch or fix that addresses the excessive memory consumption issue in the `AP4 Array<AP4 ElstEntry>::EnsureCapacity` function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bento4 version 1.6.0-639 **Description** An issue was discovered in the function `AP4 DataBuffer::ReallocateBuffer` in `Core/Ap4DataBuffer.cpp`, which leads to excessive memory consumption. **Recommendations** For Bento4 version 1.6.0-639, consider applying a patch or fix to the `AP4 DataBuffer::ReallocateBuffer` function to prevent excessive memory consumption. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Bento4 version 1.6.0-639 **Description** A memory leak issue exists in the `AP4 StdcFileByteStream::Create` function, specifically in the `System/StdC/Ap4StdCFileByteStream.cpp` file. This issue can lead to memory exhaustion if exploited. **Recommendations** For Bento4 version 1.6.0-639, consider restricting access to the `AP4 StdcFileByteStream::Create` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** JasPer version 3.0.6 **Description** The issue allows for denial of service via a reachable assertion in the function inttobits in libjasper/base/jas image.c. **Recommendations** For JasPer version 3.0.6, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bento4 version 1.6.0-639 **Description** A heap-based buffer over-read issue exists in the AP4 HvccAtom class. **Recommendations** For Bento4 version 1.6.0-639, at the moment, there is no information about a newer version that contains a fix for this issue.