CVE-2023-50120: 
NixOS vulnerability analysis and mitigation

MP4Box GPAC version 2.3-DEV-rev636-gfbd7e13aa-master was discovered to contain an infinite loop vulnerability in the function av1_uvlc located in media_tools/av_parsers.c. The vulnerability was disclosed on December 1, 2023, and affects the GPAC multimedia framework. This security issue has been assigned CVE-2023-50120 (NVD).

The vulnerability exists in the av1_uvlc function within the media_tools/av_parsers.c file at line 1664. When processing certain MP4 files, the function can enter an infinite loop condition. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 MEDIUM with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

The vulnerability allows attackers to cause a Denial of Service (DoS) condition through a specially crafted MP4 file. When exploited, the vulnerability can cause the application to enter an infinite loop, making the service unavailable to legitimate users (GitHub Issue).

The vulnerability has been identified in GPAC version 2.3-DEV-rev636-gfbd7e13aa-master. Users should update to a patched version when available. For Debian systems, the bullseye release has been marked as 'not affected' as the vulnerable code is not present (Debian Tracker).