CVE-2021-45263: 
NixOS vulnerability analysis and mitigation

An invalid free vulnerability exists in gpac 1.1.0 via the gf_svg_delete_attribute_value function, which causes a segmentation fault and application crash (Debian Security, GitHub Issue). The vulnerability was discovered in December 2021 and affects GPAC multimedia framework versions up to 1.1.0.

The vulnerability occurs in the gf_svg_delete_attribute_value function where an invalid memory address is attempted to be freed, leading to a segmentation fault. The issue manifests when processing certain SVG attributes, specifically when attempting to free the memory at address 0x4183400000000000, which is an invalid memory location (GitHub Issue).

When exploited, this vulnerability results in a denial of service condition through application crash. The segmentation fault occurs during the processing of SVG attributes, disrupting the normal operation of the GPAC multimedia framework (Debian Security).

The issue has been addressed in subsequent releases. For the Debian stable distribution (bullseye), these problems have been fixed in version 1.0.1+dfsg1-4+deb11u2 (Debian Advisory). Users are recommended to upgrade their gpac packages to the patched versions.