CVE-2022-2953: 
NixOS vulnerability analysis and mitigation

LibTIFF version 4.4.0 contains a vulnerability identified as CVE-2022-2953, which was discovered in the extractImageSection function in tools/tiffcrop.c at line 6905. The vulnerability involves an out-of-bounds read that allows attackers to cause a denial-of-service condition via a crafted TIFF file (GitLab Issue).

The vulnerability is characterized by a heap buffer overflow in the extractImageSection function. It occurs when processing TIFF files with specific parameters using the tiffcrop tool. The vulnerability has been assigned a CVSS 3.1 base score of 5.5 (Medium), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating local attack vector, low attack complexity, no privileges required, and user interaction required (Ubuntu Security).

When successfully exploited, this vulnerability can lead to a denial-of-service (DoS) condition. The impact is primarily on the availability of the system, with no direct impact on confidentiality or integrity (NetApp Security).

The vulnerability has been fixed in commit 48d6ece8 of the LibTIFF repository. For users compiling LibTIFF from sources, applying this commit resolves the issue. Various distributions have also released patched versions, such as Ubuntu's 4.4.0-4ubuntu3.1 for versions 23.04 and 22.10 (Ubuntu Security).