CVE-2022-47086: 
NixOS vulnerability analysis and mitigation

GPAC MP4Box v2.1-DEV-rev574-g9d5bb184b contains a segmentation violation vulnerability (CVE-2022-47086) in the function gf_sm_load_init_swf located at scene_manager/swf_parse.c. The vulnerability was discovered in December 2022 and affects GPAC software versions up to (excluding) 2.2.0 (NVD, MITRE).

The vulnerability is caused by a missing check of the return value from gf_swf_read_header in the gf_sm_load_init_swf function. When the function attempts to access read->width without proper validation, it triggers a segmentation violation. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD, GitHub Issue).

The vulnerability can lead to a denial of service condition through a segmentation fault when processing specially crafted SWF files. The impact is primarily on the availability of the system, with no direct impact on confidentiality or integrity (NVD).

The vulnerability requires local access and user interaction to exploit. A proof-of-concept exploit has been documented that demonstrates the segmentation fault by attempting to process a malformed SWF file using the MP4Box utility (GitHub Issue).

The vulnerability has been fixed in GPAC version 2.2.0. For Debian systems, the fix has been backported to version 1.0.1+dfsg1-4+deb11u2 in the stable distribution (bullseye). Users are recommended to upgrade their GPAC installations to the patched versions (Debian Advisory).