CVE-2018-10790 Denial of service in n/a
Remote attackers can crash the application via a memory allocation failure in the Bento4 library, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-10790?
CVE-2018-10790 is a high-severity denial of service vulnerability in Axiosys Bento4, published on 25 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (application crash), related to a memory allocation failure, as demonstrated by mp2aac.
Weakness: CWE-770
Which versions are affected by CVE-2018-10790?
It affects 1 product.
Products include Axiosys Bento4.
How do I fix CVE-2018-10790?
No fix has been published for CVE-2018-10790 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-10790 being exploited?
There is no known exploitation of CVE-2018-10790 in the wild and no public exploit code.
Other vulnerabilities in Axiosys Bento4
Sources
Also known as GHSA-pwpv-3p5r-mg69, UBUNTU-CVE-2018-10790.