CVE-2023-2837: 
NixOS vulnerability analysis and mitigation

A Stack-based Buffer Overflow vulnerability was discovered in GitHub repository gpac/gpac prior to version 2.2.2, identified as CVE-2023-2837. The vulnerability was disclosed on May 22, 2023, affecting all versions of the GPAC multimedia framework before the patched version (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium), with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. This indicates a local attack vector requiring user interaction, with no privileges required, and potential impact limited to availability (NVD, Ubuntu).

The vulnerability affects system availability with no impact on confidentiality or integrity. When successfully exploited, it can lead to a denial of service condition through a stack-based buffer overflow (NVD).

The vulnerability requires local access and user interaction to exploit. While the attack complexity is low, there are no known reports of this vulnerability being exploited in the wild at the time of assessment (NVD).

The vulnerability has been fixed in GPAC version 2.2.2. Users are advised to upgrade to this version or later. For Debian systems, the fix has been included in version 1.0.1+dfsg1-4+deb11u2 (Debian Advisory, GitHub Patch).