CVE-2022-35017: 
NixOS vulnerability analysis and mitigation

Advancecomp version 2.3 was identified with a heap buffer overflow vulnerability, tracked as CVE-2022-35017. The vulnerability was discovered and initially recorded on July 4, 2022, affecting the AdvanceCOMP compression utility package (CVE MITRE).

The vulnerability is classified with a CVSS 3.1 base score of 5.5 (Medium severity). The attack vector is Local, with low attack complexity, requiring no privileges but user interaction. The scope is unchanged, with no impact on confidentiality and integrity, but high impact on availability (Ubuntu Security).

If exploited, this vulnerability could lead to a denial of service condition. When a user is tricked into opening a specially crafted MNG file, the vulnerability could cause AdvanceCOMP to crash (Ubuntu Notice).

Multiple Linux distributions have released patches to address this vulnerability. Ubuntu has released fixes across multiple versions: Ubuntu 22.10 (2.3-1ubuntu0.22.10.1), Ubuntu 22.04 LTS (2.1-2.1ubuntu2.1), Ubuntu 20.04 LTS (2.1-2.1ubuntu0.20.04.1), Ubuntu 18.04 LTS (2.1-1ubuntu0.18.04.3), and Ubuntu 16.04 LTS (1.20-1ubuntu0.2+esm2) (Ubuntu Security).