CVE-2022-43252: 
NixOS vulnerability analysis and mitigation

Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability in the putepel16_fallback function within fallback-motion.cc. This vulnerability was assigned CVE-2022-43252 and was disclosed on November 2, 2022. The vulnerability affects the libde265 open-source implementation of the H.265 video codec (NVD).

The vulnerability is classified as a heap-buffer-overflow with a CVSS v3.1 base score of 6.5 (Medium). The issue occurs specifically in the putepel16_fallback function within the fallback-motion.cc file. The vulnerability can be triggered when processing specially crafted video files, leading to a read operation beyond the allocated buffer boundaries (Github Issue).

When exploited, this vulnerability allows attackers to cause a Denial of Service (DoS) through the processing of a specially crafted video file. The heap buffer overflow occurs during video processing operations, potentially affecting system stability and security (Debian LTS).

Multiple Linux distributions have released patches to address this vulnerability. Debian has fixed the issue in version 1.0.11-0+deb11u1 for the stable distribution (bullseye). Ubuntu has addressed the vulnerability in versions 1.0.8-1ubuntu0.1 (22.04), 1.0.4-1ubuntu0.2 (20.04), and 1.0.2-2ubuntu0.18.04.1~esm2 (18.04) (Debian Security, Ubuntu Security).