CVE-2020-19751: 
NixOS vulnerability analysis and mitigation

An issue was discovered in gpac 0.8.0 affecting the gfodfdelipmptool function in odf_code.c. The vulnerability was identified with CVE-2020-19751 and involves a heap-based buffer over-read vulnerability (NVD, GitHub Issue).

The vulnerability exists in the gfodfdelipmptool function within odf_code.c at line 3295. The issue stems from improper size checking that leads to a heap buffer overflow. When triggered, the vulnerability causes the function to free an invalid memory address. The severity of this vulnerability is rated as CRITICAL with a CVSS v3.1 Base Score of 9.1 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) (NVD).

The heap-based buffer over-read can lead to information disclosure and potential system crashes. The high CVSS score indicates that this vulnerability can be exploited remotely without requiring privileges or user interaction, potentially leading to high impacts on confidentiality and availability of the affected system (NVD).

The vulnerability affects GPAC version 0.8.0. Users should upgrade to a patched version of the software. The issue has been reported and documented in the project's issue tracking system (GitHub Issue).