CVE-2023-46932: 
NixOS vulnerability analysis and mitigation

A Heap Buffer Overflow vulnerability was discovered in GPAC version 2.3-DEV-rev617-g671976fcc-master, specifically in the str2ulong class within src/media_tools/avilib.c in gpac/MP4Box. The vulnerability was assigned CVE-2023-46932 and was disclosed in December 2023. This security flaw allows attackers to execute arbitrary code and cause a denial of service (DoS) (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue specifically occurs in the str2ulong function at src/media_tools/avilib.c:137:16, where a heap-buffer-overflow is triggered during the processing of AVI files. The vulnerability is classified as CWE-787 (Out-of-bounds Write) (NVD, GitHub Issue).

The vulnerability's impact is severe as it allows attackers to execute arbitrary code and cause denial of service conditions. The critical CVSS score of 9.8 indicates that successful exploitation could lead to complete system compromise, with high impacts on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability affects GPAC version 2.3-DEV-rev617-g671976fcc-master. Users should update to a patched version when available. For Debian-based systems, the issue is tracked and marked as vulnerable in various distributions including bullseye (Debian Tracker).