CVE-2021-29463: 
NixOS vulnerability analysis and mitigation

CVE-2021-29463 affects Exiv2, a command-line utility and C++ library for reading, writing, deleting, and modifying image file metadata, in versions v0.27.3 and earlier. The vulnerability was discovered in April 2021 and fixed in version v0.27.4 (GitHub Advisory).

The vulnerability is an out-of-bounds read issue in the Exiv2::WebPImage::doWriteMetadata function. The vulnerability is triggered specifically when Exiv2 is used to write metadata into a crafted image file. The issue has a CVSS v3.1 base score of 5.5 MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) according to NVD assessment (NVD).

An attacker could potentially exploit this vulnerability to cause a denial of service by crashing Exiv2 if they can trick the victim into running Exiv2 on a crafted image file. The impact is limited as the bug is only triggered when writing metadata, which is a less frequently used Exiv2 operation than reading metadata (GitHub Advisory).

The vulnerability has been fixed in Exiv2 version v0.27.4. Users should upgrade to this version or later to mitigate the issue. Various Linux distributions have also released security updates to address this vulnerability, including Fedora and Ubuntu (Fedora Update).