A double free vulnerability exists in L-SMASH through 2.14.5 in the HEVC and H.264 importer probe. This issue can lead to use-after-free, heap corruption, and crashes when processing a crafted Annex-B elementary stream. The vulnerability is triggered by supplying a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or certain tools. Defenders should prioritize verifying the vu [truncated]
CVE-2016-20099 is a vulnerability in L-SMASH through version 2.14.5, which contains an infinite loop in the VC-1 importer probe. This allows attackers to cause a denial of service by supplying a crafted input file, specifically a file consisting only of zero bytes, leading to indefinite CPU consumption. The vulnerability can cause denial of service through CPU consumption and potential system hang or cras [truncated]
