CVE-2020-15365: 
NixOS vulnerability analysis and mitigation

CVE-2020-15365 affects LibRaw versions before 0.20-Beta3. The vulnerability is an out-of-bounds write in the parse_exif() function located in metadata\exif_gps.cpp, which can be triggered when processing certain image files (Debian Security).

The vulnerability exists within the LibRaw::parse_exif() function in metadata\exif_gps.cpp. The out-of-bounds write condition occurs when an unrecognized AtomName is encountered along with a zero value of tiff_nifds. This can lead to memory corruption when processing specially crafted image files (LibRaw Issue).

When successfully exploited, this vulnerability can lead to memory corruption through an out-of-bounds write operation, potentially allowing an attacker to execute arbitrary code or cause the application to crash when processing maliciously crafted image files (LibRaw Issue).

The vulnerability can be triggered by processing specially crafted image files that contain manipulated AtomName values and specific tiff_nifds field settings. A proof-of-concept exploit has been demonstrated using modified CR3 image files (LibRaw Issue).

Users should upgrade to LibRaw version 0.20-Beta3 or later which contains the fix for this vulnerability. The issue has been addressed in various Linux distributions through their respective security updates (Debian Security).