CVE-2022-29978: 
NixOS vulnerability analysis and mitigation

CVE-2022-29978 is a floating point exception (FPE) vulnerability discovered in libsixel img2sixel version 1.8.6. The vulnerability was disclosed on May 11, 2022, affecting the sixelencoderdo_resize function in encoder.c at line 633. This vulnerability impacts the libsixel library, which is used for image processing and conversion (NVD, GitHub Issue).

The vulnerability exists in the sixelencoderdo_resize function within encoder.c. When processing certain crafted JPEG files, the function can trigger a floating point exception at line 633. The issue has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

When successfully exploited, this vulnerability can lead to a denial-of-service condition in applications using the affected libsixel library. The impact is primarily on the availability of the service, as remote attackers can cause the application to crash by submitting specially crafted JPEG files for processing (GitHub Issue).

The vulnerability affects libsixel version 1.8.6. Users should update to a patched version of the library when available. As of the latest tracking information, the vulnerability remains active in multiple distributions including bullseye, bookworm, trixie, and sid (Debian Tracker).