CVE-2020-35523: 
NixOS vulnerability analysis and mitigation

CVE-2020-35523 is an integer overflow vulnerability discovered in the libtiff library, specifically in the tif_getimage.c file. The vulnerability was disclosed in March 2021 and affects libtiff versions prior to 4.2.0. This security flaw impacts various operating systems and distributions that use the libtiff library for handling TIFF format image files (NVD, Red Hat).

The vulnerability is characterized by an integer overflow condition in the tif_getimage.c file, specifically in the gtTileContig() function. The flaw received a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating high potential impact on confidentiality, integrity, and availability (NetApp Advisory).

The vulnerability can allow an attacker to inject and execute arbitrary code when a user opens a specially crafted TIFF file. The highest threats from this vulnerability are to system confidentiality, integrity, and availability. This could potentially lead to unauthorized code execution with the privileges of the process handling the malicious TIFF file (NVD, Gentoo Security).

The vulnerability requires user interaction, specifically opening a maliciously crafted TIFF file. The attack complexity is considered low, requiring no special privileges for exploitation, though it does need local access to the system (NetApp Advisory).

The vulnerability has been fixed in libtiff version 4.2.0. Users and administrators are strongly advised to upgrade to this version or apply appropriate patches provided by their distribution vendors. Various Linux distributions have released security updates to address this vulnerability, including Red Hat Enterprise Linux, Debian, Ubuntu, and Gentoo (Debian Security, Red Hat Advisory).