CVE-2020-23928: 
NixOS vulnerability analysis and mitigation

An issue was discovered in gpac before version 1.0.1, identified as CVE-2020-23928. The vulnerability involves a heap-based buffer over-read in the abst_box_read function within the box_code_adobe.c file (NVD, CVE).

The vulnerability is classified as a heap-based buffer over-read (CWE-125) with a CVSS v3.1 Base Score of 7.1 (HIGH). The attack vector is Local (L), with Low attack complexity (L), requiring No privileges (N) and User interaction (R). The scope is Unchanged (U), with High impact on Confidentiality (H), No impact on Integrity (N), and High impact on Availability (H) (NVD).

The buffer over-read vulnerability could lead to exposure of sensitive information from memory or potentially cause a system crash. By reading out-of-bounds memory, an attacker might be able to obtain secret values, such as memory addresses, which could be used to bypass protection mechanisms like ASLR (CWE).

The vulnerability requires local access and user interaction to exploit. Two specific instances of the heap-buffer-overflow were identified in box_code_adobe.c at lines 124 and 141, as demonstrated through AddressSanitizer analysis (GitHub Issue 1568, GitHub Issue 1569).

The vulnerability was fixed in gpac version 1.0.1. The fix involved correcting the buffer size calculation in the abst_box_read function (GitHub Commit).