CVE-2022-43239: 
NixOS vulnerability analysis and mitigation

Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_chroma in motion.cc. The vulnerability was identified and disclosed on October 10, 2022, affecting the open-source H.265 video codec implementation (GitHub Issue, NVD).

The vulnerability is a heap-buffer-overflow that occurs in the mc_chroma function within the motion.cc file. The issue manifests as a READ operation of size 2 at a memory location outside the allocated buffer bounds. The vulnerability was discovered through testing with Address Sanitizer (ASAN), which detected the buffer overflow during video file processing (GitHub Issue).

When exploited, this vulnerability allows attackers to cause a Denial of Service (DoS) by processing a specially crafted video file. The heap-buffer-overflow could potentially lead to system crashes or unpredictable behavior (Debian LTS).

Multiple distributions have released patches to address this vulnerability. Ubuntu users can update to libde265-0 version 1.0.4-1ubuntu0.2 for Ubuntu 20.04 and version 1.0.8-1ubuntu0.1 for Ubuntu 22.04. Debian users should upgrade to version 1.0.11-0+deb11u1 for the bullseye distribution (Ubuntu Notice, Debian Security).