CVE-2020-18652: 
NixOS vulnerability analysis and mitigation

CVE-2020-18652 is a Buffer Overflow vulnerability discovered in WEBP_Support.cpp component of exempi version 2.5.0 and earlier. The vulnerability allows remote attackers to cause a denial of service through the opening of a crafted WebP file (NVD, CVE).

The vulnerability exists in the VP8XChunk::VP8XChunk function within WEBP_Support.cpp. The issue occurs when processing WebP files where the buffer pointed by bitstream was allocated with only 6 bytes, but the code attempts to access beyond this allocation. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD, GitLab Issue).

When exploited, this vulnerability can lead to a denial of service condition through a heap-based buffer over-read. The impact is limited to availability, with no direct impact on confidentiality or integrity of the system (NVD, Debian Security).

The vulnerability has been fixed in subsequent releases of exempi. Various Linux distributions have released security updates to address this issue, including Debian which fixed it in version 2.5.0-2+deb10u1 (Debian LTS). Users are recommended to upgrade to the latest version of the software.