CVE-2020-0198: 
NixOS vulnerability analysis and mitigation

CVE-2020-0198 is a vulnerability discovered in the exif_data_load_data_content function of exif-data.c within the libexif library. The vulnerability was disclosed in June 2020 and affects Android 10 and various Linux distributions. It involves an integer overflow condition that could lead to a UBSAN (Undefined Behavior Sanitizer) abort (NVD).

The vulnerability is characterized by an integer overflow in the exif_data_load_data_content function of exif-data.c. It has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound) (NVD).

When exploited, this vulnerability can lead to a remote denial of service condition with no additional execution privileges needed. The impact is primarily focused on system availability, with no direct impact on confidentiality or integrity (NVD, Debian Security).

The vulnerability requires user interaction for exploitation, though it can be triggered remotely. No additional execution privileges are needed to exploit this vulnerability (NVD).

Multiple vendors have released patches to address this vulnerability. Ubuntu released updates for versions 12.04 through 20.04 LTS in USN-4396-1. Debian provided fixes in version 0.6.21-2+deb8u4 for Jessie. Fedora released updates in versions 0.6.22-2.fc32 and 0.6.22-3.fc33. Gentoo fixed the issue in version 0.6.22_p20201105 (Ubuntu Security, Debian Security, Fedora Update, Gentoo Security).