CVE-2021-3482: 
NixOS vulnerability analysis and mitigation

CVE-2021-3482 is a security vulnerability discovered in Exiv2, affecting versions before and including 0.27.4-RC1. The vulnerability involves improper input validation of the rawData.size property in the Jp2Image::readMetadata() function within jp2image.cpp (NVD, Red Hat).

The vulnerability is classified as a heap-based buffer overflow vulnerability with a CVSS v3.1 base score of 6.5 (Medium). The flaw exists in the Jp2Image::readMetadata() function due to improper validation of the rawData.size property, which can be triggered when processing malicious EXIF data in JPG images (Red Hat, NVD).

The vulnerability can lead to a heap-based buffer overflow when processing crafted JPG images containing malicious EXIF data. This could potentially result in information leakage from heap data, program crashes affecting availability, or in some cases, arbitrary code execution (Red Hat).

The vulnerability has been fixed in Exiv2 version 0.27.4-RC2. Various Linux distributions have released security updates to address this issue, including Red Hat Enterprise Linux 8 via RHSA-2021:4173, Debian via DSA-4958-1, and Fedora 33/34 through their respective security updates (Debian, Red Hat).