CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2025-8537

A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_DataBuffer::SetDataSize of the file Mp4Decrypt.cpp of the component mp4decrypt. The manipulation leads to allocation of resources. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.

Score
2.9 low
Published
2025-08-05
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
multimedia/Bento4Bento41.6.0_3unaddressedrodrigo@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>Bento4</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A vulnerability, which was classified as problematic, was found in
	Axiomatic Bento4 up to 1.6.0-641. Affected is the function
	AP4_DataBuffer::SetDataSize of the file Mp4Decrypt.cpp of the
	component mp4decrypt. The manipulation leads to allocation of
	resources. It is possible to launch the attack remotely. The
	complexity of an attack is rather high. The exploitability is told to
	be difficult. The exploit has been disclosed to the public and may be
	used.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-8537</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-8537</url>
    </references>
    <dates>
      <discovery>2025-08-05</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>