CVE-2021-37615: 
NixOS vulnerability analysis and mitigation

CVE-2021-37615 affects Exiv2, a command-line utility and C++ library for reading, writing, deleting, and modifying image file metadata. The vulnerability was discovered in versions v0.27.4 and earlier, and was fixed in version v0.27.5. This security issue involves a null pointer dereference that occurs when processing metadata of crafted image files (GitHub Advisory).

The vulnerability is a null pointer dereference in the Exiv2::Internal::resolveLens0x319 function. The issue is triggered specifically when using Exiv2 to print interpreted (translated) metadata, which requires special command line options (-p t or -P t). The vulnerability has been assigned a CVSS v3.1 score of 4.7 (Medium) with the vector string CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H (GitHub Advisory).

If exploited, this vulnerability could lead to a denial of service condition when a victim is tricked into running Exiv2 on a specially crafted image file. The impact is limited by the fact that it requires user interaction and only occurs during a less frequently used operation that needs specific command line options (GitHub Advisory).

The vulnerability has been fixed in Exiv2 version v0.27.5. Users are advised to upgrade to this or later versions. Multiple Linux distributions have released security updates to address this vulnerability, including Fedora and Ubuntu (Fedora Update).