CVE-2021-28278: 
NixOS vulnerability analysis and mitigation

A Heap-based Buffer Overflow vulnerability was identified in jhead versions 3.04 and 3.05, specifically in the RemoveSectionType function within jpgfile.c. The vulnerability was assigned CVE-2021-28278 and was discovered in March 2021 (MITRE CVE, Debian Security).

The vulnerability is a heap-based buffer overflow that occurs during read operations in the RemoveSectionType function in jpgfile.c. The issue was identified using AddressSanitizer, which detected a heap-buffer-overflow on memory reads of size 160 bytes (GitHub Issue). The vulnerability has been assigned a CVSS v3 Base Score of 7.8 (High), with an Impact Score of 5.9 and Exploitability Score of 1.8. The attack vector is Local, requiring user interaction but no privileges (AttackerKB).

The vulnerability could potentially lead to denial of service conditions and possible code execution. The CVSS metrics indicate high potential impact on confidentiality, integrity, and availability of the affected system (AttackerKB).

Users are advised to upgrade to jhead version 3.06.0.1 or later, which contains fixes for this vulnerability. For Gentoo users, the recommended mitigation is to execute 'emerge --sync' followed by 'emerge --ask --oneshot --verbose ">=media-gfx/jhead-3.06.0.1"' (Gentoo Security).