CVE-2022-2061: 
NixOS vulnerability analysis and mitigation

A Heap-based Buffer Overflow vulnerability (CVE-2022-2061) was discovered in GitHub repository hpjansson/chafa prior to version 1.12.0. The vulnerability was disclosed on June 13, 2022, and affects the chafa project's codebase (CVE Details, NVD).

The vulnerability is classified as a Heap-based Buffer Overflow (CWE-122) and Out-of-bounds Write (CWE-787). It received a CVSS v3.1 base score of 3.3 (LOW) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating local access is required with low attack complexity and low privileges needed (NVD).

The vulnerability allows for potential information disclosure through local access, as indicated by the CVSS metrics. The confidentiality impact is rated as low, while there are no direct impacts on integrity or availability (NVD).

The vulnerability requires local access with low attack complexity and low privileges for exploitation. No known exploits in the wild have been reported at the time of assessment (NVD).

The vulnerability has been fixed in version 1.12.0 of the chafa project. Users should upgrade to this version or later to mitigate the vulnerability. A patch has been implemented to prevent out-of-bounds access in the lzw_decode function (GitHub Patch).