CVE-2020-23922: 
NixOS vulnerability analysis and mitigation

An issue was discovered in giflib through version 5.1.4, identified as CVE-2020-23922. The vulnerability specifically affects the DumpScreen2RGB function in gif2rgb.c, which contains a heap-based buffer over-read vulnerability. This issue was discovered in August 2020 and publicly disclosed in April 2021 (NVD).

The vulnerability is classified as a heap-based buffer over-read (CWE-125) in the DumpScreen2RGB function within gif2rgb.c. The CVSS v3.1 base score is 7.1 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H. The vulnerability requires local access and user interaction, but no privileges, and can potentially lead to high impacts on confidentiality and availability (NVD).

The heap-based buffer over-read vulnerability can lead to exposure of sensitive information or potentially cause a program crash. By reading out-of-bounds memory, an attacker might be able to access secret values, such as memory addresses, which could be used to bypass protection mechanisms like ASLR (CWE).

The vulnerability has been confirmed with a proof-of-concept exploit. The issue can be triggered using the gif2rgb utility, and a reproducer was documented in the bug report. The vulnerability specifically affects the command-line tool and was confirmed through testing with AddressSanitizer (SourceForge).

The issue has been fixed in giflib version 5.2.2-1. For systems where updates are not immediately available, users should be cautious when processing untrusted GIF files with the gif2rgb utility. The project maintainers have updated the manual page to warn users that processing malformed GIFs can crash the utility (Debian).