CVE-2022-43240: 
NixOS vulnerability analysis and mitigation

CVE-2022-43240 affects Libde265 version 1.0.8, which contains a heap-buffer-overflow vulnerability in the ff_hevc_put_hevc_qpel_h_2_v_1_sse function within sse-motion.cc. This vulnerability was discovered in October 2022 and allows attackers to cause a Denial of Service (DoS) via a crafted video file (Github Issue, NVD).

The vulnerability is classified as a heap-buffer-overflow that occurs in the ff_hevc_put_hevc_qpel_h_2_v_1_sse function located in sse-motion.cc. The CVSS v3.1 base score is 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The issue is categorized under CWE-787 (Out-of-bounds Write) (NVD).

When exploited, this vulnerability allows attackers to cause a Denial of Service (DoS) through a specially crafted video file. The impact is primarily focused on system availability, with no direct impact on confidentiality or integrity (NVD, Github Issue).

Multiple distributions have released patches to address this vulnerability. Debian has released security updates in version 1.0.11-0+deb11u1 for the stable distribution (bullseye) and version 1.0.3-1+deb10u2 for Debian 10 (buster) (Debian Advisory, Debian LTS).