CVE-2021-3575: 
NixOS vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability (CVE-2021-3575) was discovered in OpenJPEG's color.c file, specifically in the sycc420torgb function at line 379:42. The vulnerability affects OpenJPEG versions up to and including 2.4.0. The issue was discovered and reported on April 30, 2021, and involves the processing of crafted .j2k files (OpenJPEG Issue).

The vulnerability stems from insufficient validation of the *cb pointer in the sycc420torgb function when decompressing .j2k files. The issue manifests as a heap-based buffer overflow, which occurs during color space conversion operations. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

When exploited, this vulnerability could allow an attacker to execute arbitrary code with the permissions of the application compiled against OpenJPEG. The impact is particularly severe as it could lead to unauthorized code execution or denial of service conditions (Red Hat Bugzilla).

The vulnerability has been addressed in various distribution releases. Fedora has released security updates for versions 33 and 34, Ubuntu has provided fixes for multiple releases including 20.04 LTS and 22.04 LTS, and Red Hat has issued patches through RHSA-2021:4251 (Fedora Update, Ubuntu Security).