CVE-2020-0296: 
NixOS vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability was discovered in OpenJPEG through version 2.3.1. The vulnerability, identified as CVE-2020-6851, exists in the opj_t1_clbl_decode_processor function within the openjp2/t1.c file due to insufficient validation in opj_j2k_update_image_dimensions (MITRE CVE).

The vulnerability is specifically located in the opj_t1_clbl_decode_processor function of OpenJPEG's source code, affecting the image dimension validation process. The issue stems from inadequate validation in the opj_j2k_update_image_dimensions functionality, which could lead to a heap-based buffer overflow condition (GitHub Issue).

The vulnerability affects OpenJPEG, an open-source library used for reading and writing image files in JPEG2000 format. When exploited, the heap-based buffer overflow could potentially lead to memory corruption and possible code execution (Red Hat Advisory).

Various vendors have released security updates to address this vulnerability. Red Hat has provided patches for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions, and Debian has also issued security updates through DSA-4882 (Red Hat Advisory, Debian Advisory).