CVE-2020-24890: 
NixOS vulnerability analysis and mitigation

LibRaw 20.0 contains a null pointer dereference vulnerability identified as CVE-2020-24890, located in the parse_tiff_ifd function within src/metadata/tiff.cpp. The vulnerability was discovered in August 2020 and publicly disclosed in September 2020. This security flaw affects LibRaw, a library used for reading RAW files obtained from digital photo cameras (NVD, Gentoo Security).

The vulnerability is characterized by a null pointer dereference in the parse_tiff_ifd function within src/metadata/tiff.cpp. According to the National Vulnerability Database, the severity is rated as MEDIUM with a CVSS v3.1 Base Score of 5.5, and the attack vector requires local access with no privileges but user interaction. The vulnerability is tracked under CWE-476 (NULL Pointer Dereference) (NVD).

The vulnerability may result in context-dependent arbitrary code execution or a denial of service condition when processing specially crafted image files. The impact is particularly relevant when the affected library is used in applications processing image files from untrusted sources (NVD, Gentoo Security).

The vulnerability has been addressed in subsequent versions of LibRaw. Users are advised to upgrade to LibRaw version 0.20.0 or later. Various Linux distributions have released security updates to address this vulnerability, including Fedora and Gentoo (Fedora Update, Gentoo Security).