CVE-2022-45204: 
NixOS vulnerability analysis and mitigation

GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to contain a memory leak vulnerability in the function dimC_box_read located at isomedia/box_code_3gpp.c. The vulnerability was disclosed on November 28, 2022 and affects GPAC software versions up to (excluding) 2.2.0 (NVD).

The vulnerability is a memory leak that occurs in the dimC_box_read function at line 1060 of isomedia/box_code_3gpp.c. The issue involves a direct leak of 2566 bytes in a single object allocation. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating local attack vector, low attack complexity, no privileges required, and user interaction required (NVD).

The vulnerability affects the availability of the system through memory resource exhaustion. When exploited, it can lead to a denial of service condition due to the uncontrolled memory leak, potentially impacting system performance and stability (NVD).

The vulnerability was addressed in GPAC version 2.2.0. Users are advised to upgrade to this version or later to mitigate the risk (NVD).