CVE-2023-23145: 
NixOS vulnerability analysis and mitigation

GPAC version 2.2-rev0-gab012bbfb-master contains a memory leak vulnerability in the lsr_read_rare_full function, identified as CVE-2023-23145. The vulnerability was discovered in January 2023 and affects the GPAC multimedia framework (NVD, CVE).

The vulnerability is classified as a Missing Release of Memory after Effective Lifetime (CWE-401) issue. It has been assigned a CVSS v3.1 base score of 7.8 (HIGH), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access vector, low attack complexity, no privileges required, and user interaction required (NVD).

The memory leak vulnerability can lead to resource exhaustion and potential denial of service conditions. The CVSS score indicates potential high impacts on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires local access and user interaction to exploit. No public exploits have been reported in the wild at the time of assessment (NVD).

A fix has been released in the Debian distribution with version 1.0.1+dfsg1-4+deb11u2. The patch involves proper memory management in the lsr_read_rare_full function (Debian Advisory, GitHub Patch).