CVE-2023-37174: 
NixOS vulnerability analysis and mitigation

GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the dumpisomscene function at /mp4box/filedump.c. The vulnerability was discovered and reported on June 27, 2023, affecting the GPAC multimedia framework. The issue was assigned CVE-2023-37174 and received a CVSS v3.1 base score of 5.5 (Medium) (NVD).

The vulnerability manifests as a segmentation violation (SEGV) occurring at memory address 0x000000012c29 in the dumpisomscene function, specifically at line 226 in /mp4box/filedump.c. The issue is triggered when processing certain MP4 files, particularly during MPEG-4 LASeR Scene Parsing. The crash occurs during the decoding of sample 1 from track ID 8, leading to a READ memory access violation (GitHub Issue).

The vulnerability can result in software crashes, potential bypass of protection mechanisms, and memory modification. The CVSS score of 5.5 indicates a medium severity with local attack vector, low attack complexity, no privileges required, and user interaction required. While the primary impact is on availability through program crashes, there are no direct impacts on confidentiality or integrity (NVD).

The vulnerability was reported in version 2.3-DEV-rev381-g817a848f6-master of GPAC. Users should update to a patched version when available. No specific workarounds have been publicly documented (NVD).