CVE-2020-14153: 
NixOS vulnerability analysis and mitigation

CVE-2020-14153 affects IJG JPEG (also known as libjpeg) versions 8 through 9c. The vulnerability involves an out-of-bounds array read for certain table pointers in the jdhuff.c file (NVD, CVE). The issue was discovered and disclosed on June 15, 2020.

The vulnerability exists in the jdhuff.c file where there is an out-of-bounds array read condition related to table pointers. The fix implemented in version 9d involves modifying how AC tables are handled, specifically by adding a check to ensure AC tables are only used when present: entropy->ac_cur_tbls[blkn] = cinfo->lim_Se ? entropy->ac_derived_tbls[compptr->ac_tbl_no] : NULL (Gentoo Bug).

The vulnerability could potentially lead to information disclosure through out-of-bounds array reads. The CVSS v3.1 base score is 7.1 (High), with impact metrics showing high confidentiality and availability impacts, while integrity remains unaffected (Ubuntu).

The vulnerability requires local access and user interaction to exploit, with low attack complexity and no privileges required. The attack vector is local, indicating that the attacker needs local access to the target system to exploit the vulnerability (Ubuntu).

The vulnerability was fixed in IJG JPEG version 9d. Users should upgrade to this version or later to mitigate the issue. It's worth noting that libjpeg-turbo, a separate implementation, is not affected by this vulnerability as confirmed by the project maintainers (Libjpeg-turbo Issue).