CVE-2020-15503: 
NixOS vulnerability analysis and mitigation

LibRaw before version 0.20-RC1 contains a vulnerability identified as CVE-2020-15503, which involves a missing thumbnail size range check. The vulnerability affects multiple components including decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. The issue was discovered in July 2020 and impacts various Linux distributions and applications that use the LibRaw library for processing RAW image files (CVE Mitre, Debian Security).

The vulnerability stems from a lack of validation for the T.tlength parameter when performing memory allocation using malloc(sizeof(libraw_processed_image_t)+T.tlength). This oversight could lead to buffer overflow conditions. The issue has been assigned a CVSS v3 score of 7.5 (High severity), indicating significant potential impact (Red Hat Portal, Ubuntu Security).

The vulnerability could potentially lead to buffer overflow conditions when processing thumbnail images. This could result in out-of-bounds memory accesses, which might cause application crashes, leading to denial of service conditions (Debian LTS).

The vulnerability can be triggered through the processing of specially crafted RAW image files that contain malformed thumbnail data. No authentication is required to exploit this vulnerability, though user interaction is needed to process the malicious file (Ubuntu Security).

The vulnerability has been fixed in LibRaw version 0.20-RC1 and later releases. Various Linux distributions have released security updates to address this issue, including Ubuntu (0.19.5-1ubuntu1.1 for focal), Debian (0.19.2-2+deb10u2 for buster), and Fedora (0.19.5-4 for versions 31 and 32) (Debian LTS, Fedora Update).