CVE-2021-33364: 
NixOS vulnerability analysis and mitigation

Memory leak in the defparentbox_new function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file. The vulnerability was assigned CVE-2021-33364 and was discovered in May 2021 (MITRE CVE).

The vulnerability is a memory leak issue that occurs in the defparentbox_new function within MP4Box component of GPAC 1.0.1. The issue allows attackers to read memory through specially crafted files. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (Ubuntu Security).

The vulnerability can lead to unauthorized memory access, potentially exposing sensitive information from the system's memory. The CVSS scoring indicates high confidentiality impact, while integrity and availability remain unaffected (Ubuntu Security).

The vulnerability has been fixed in GPAC version 1.0.1+dfsg1-4+deb11u2 for Debian's stable distribution (bullseye). Users are recommended to upgrade their GPAC packages to the patched version. The fix was implemented through a commit that addresses the memory leak issue (Debian Security, GPAC Commit).