CVE-2022-32323: 
NixOS vulnerability analysis and mitigation

CVE-2022-32323 is a heap overflow vulnerability discovered in AutoTrace version 0.40.0, specifically in the ReadImage function located at input-bmp.c:660. The vulnerability was disclosed on July 14, 2022, and affects the bitmap to vector graphics conversion functionality of AutoTrace (NVD).

The vulnerability is classified as a heap buffer overflow (CWE-787: Out-of-bounds Write) with a CVSS v3.1 base score of 7.3 (HIGH). The attack vector is local (AV:L), requiring low attack complexity (AC:L) with no privileges required (PR:N), but user interaction is needed (UI:R). The scope is unchanged (S:U) with high impacts on confidentiality (C:H) and integrity (I:H), and low impact on availability (A:L) (NVD).

The heap overflow vulnerability could potentially lead to arbitrary code execution or program crashes when processing maliciously crafted BMP files. The vulnerability affects the core functionality of AutoTrace when converting bitmap images to vector graphics (Red Hat).

A fix has been released in the form of a patch that addresses the heap overflow issue. Users are advised to update to the patched version. For Fedora users, updates are available through the package manager (autotrace-0.31.9-1) for both Fedora 36 and 37 (Fedora Update).