CVE-2021-35452: 
NixOS vulnerability analysis and mitigation

CVE-2021-35452 is an Incorrect Access Control vulnerability discovered in libde265 version 1.0.8, specifically affecting the slice.cc component. The vulnerability was disclosed on January 10, 2022, and affects the libde265 library, which is an open source implementation of the h.265 video codec (NVD, Debian LTS).

The vulnerability manifests as a segmentation fault (SEGV) in the slice.cc file of libde265. The issue occurs due to a READ memory access error, specifically in the slice_segment_header::read function. The CVSS v3.1 base score for this vulnerability is 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating that it requires user interaction but can be exploited remotely without authentication (NVD).

The vulnerability can lead to a Denial of Service (DoS) condition when exploited, causing the application to crash due to the segmentation fault. This primarily affects the availability of systems using the vulnerable version of libde265 (Debian LTS).

Multiple distributions have released patches to address this vulnerability. Debian has fixed the issue in version 1.0.3-1+deb10u1 for Debian 10 (Buster) and version 1.0.11-0+deb11u1 for Debian 11 (Bullseye). Users are recommended to upgrade their libde265 packages to the patched versions (Debian Security, Debian LTS).