CVE-2020-36277: 
NixOS vulnerability analysis and mitigation

CVE-2020-36277 affects Leptonica versions before 1.80.0, where a denial of service vulnerability exists due to an incorrect left shift in the pixConvert2To8 function within pixconv.c. The vulnerability was discovered and disclosed on March 11, 2021 (NVD, Debian LTS).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is characterized by its network attack vector, low attack complexity, and requires no privileges or user interaction. The scope is unchanged, with no impact on confidentiality or integrity, but high impact on availability (NVD).

When exploited, this vulnerability can result in a denial of service condition through application crash, specifically when processing certain input through the pixConvert2To8 function (Gentoo Security).

The vulnerability can be triggered remotely without requiring authentication or user interaction, making it relatively straightforward to exploit. The issue was initially discovered through ClusterFuzz testing (Debian LTS).

The vulnerability has been fixed in Leptonica version 1.80.0. Users are advised to upgrade to this version or later. Multiple distributions have released security updates, including Debian, Fedora, and Gentoo (Debian LTS, Gentoo Security).