CVE-2023-46871: 
NixOS vulnerability analysis and mitigation

GPAC version 2.3-DEV-rev602-ged8424300-master contains a memory leak vulnerability (CVE-2023-46871) in the MP4Box component, specifically in the NewSFDouble function located at scenegraph/vrml_tools.c:300. The vulnerability was discovered and reported on October 23, 2023, and affects GPAC version 2.3-DEV-rev602-ged8424300-master and earlier versions (GitHub Issue, NIST NVD).

The vulnerability manifests as a direct memory leak of 8 bytes in a single object allocation within the NewSFDouble function. The leak occurs during the MPEG-4 BIFS Scene Parsing process when processing certain MP4 files. According to the AddressSanitizer analysis, the leak originates from a malloc call in the NewSFDouble function and propagates through gf_sg_vrml_field_pointer_new. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (NIST NVD).

The vulnerability can lead to a denial of service condition in the affected GPAC MP4Box component. While the impact requires user interaction, such as accessing a malicious page or opening a malicious file, it can affect the system's resource management and potentially cause service disruption (GitHub Issue).

Users are advised to update to a newer version of GPAC or apply the latest commit that addresses this vulnerability. The issue was reported to the vendor on October 23, 2023, and was promptly fixed on the same day (GitHub Gist).