CVE-2020-0452: 
NixOS vulnerability analysis and mitigation

In exif_entry_get_value of exif-entry.c within libexif, a vulnerability was discovered involving a possible out-of-bounds write due to an integer overflow. The vulnerability, identified as CVE-2020-0452, affects Android versions 8.0 through 11, and various Linux distributions using the libexif library. This security flaw was discovered in 2019 and publicly disclosed in November 2020 (CVE Details).

The vulnerability exists in the exif_entry_get_value function of exif-entry.c, where an integer overflow condition can lead to an out-of-bounds write. The issue affects the libexif library, which is commonly used for parsing, editing, and saving EXIF metadata from images. The vulnerability has been assigned a security impact rating of Important by Red Hat (Red Hat Advisory).

If exploited, this vulnerability could lead to remote code execution if a third-party application uses the affected library to process remote image data. No additional execution privileges are required for exploitation, and user interaction is not needed (CVE Details).

The vulnerability can be exploited remotely through the processing of malicious image data, requiring no user interaction or special privileges. The attack vector involves third-party applications that process remote image data using the affected library (CVE Details).

Multiple vendors have released patches to address this vulnerability. Red Hat has provided updates for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions (Red Hat Advisory). Fedora has released version 0.6.22-2.fc32 for Fedora 32 and version 0.6.22-3.fc33 for Fedora 33 (Fedora Update). Gentoo users should upgrade to version 0.6.22_p20201105 or later (Gentoo Advisory).