CVE-2020-29385: 
NixOS vulnerability analysis and mitigation

GNOME gdk-pixbuf (GdkPixbuf) before version 2.42.2 contains a vulnerability identified as CVE-2020-29385, discovered in December 2020. The vulnerability allows a denial of service through an infinite loop condition in the lzw.c file's write_indexes function. This vulnerability affects multiple operating systems including Ubuntu 20.04/20.10, Fedora 33/34, and Gentoo systems (NVD, Ubuntu Security).

The vulnerability occurs in the write_indexes function within lzw.c when c->self_code equals 10, causing self->code_table[10].extends to assign the value 11 to c. Subsequently, the next loop execution assigns self->code_table[11].extends to c, which returns the value 10, resulting in an infinite loop. The vulnerability has a CVSS v3.1 Base Score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause a denial of service condition by triggering an infinite loop when processing specially crafted GIF images with LZW compression. The impact primarily affects availability with no direct impact on confidentiality or integrity (Gentoo Security).

The vulnerability can be triggered by opening a specially crafted GIF image with LZW compression in an application that uses the GDK-PixBuf library. It requires user interaction to open the malicious file, and the attack can be executed either locally or remotely (Ubuntu Security).

The vulnerability was fixed in GDK-PixBuf version 2.42.2. Users and system administrators are advised to upgrade to this version or later. For specific distributions: Ubuntu users should update to version 2.40.0+dfsg-5ubuntu0.1 (20.10) or 2.40.0+dfsg-3ubuntu0.1 (20.04 LTS), Fedora users should update to version 2.42.2, and Gentoo users should upgrade to version 2.42.2 or later (Ubuntu Security, Gentoo Security).