CVE-2023-1916: 
NixOS vulnerability analysis and mitigation

A flaw was found in tiffcrop, a program distributed by the libtiff package. The vulnerability (CVE-2023-1916) was discovered in April 2023 and affects libtiff versions 4.x. A specially crafted TIFF file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c (NVD, Ubuntu).

The vulnerability is a heap-buffer-overflow that occurs in the extractImageSection function in tools/tiffcrop.c, specifically at line 7847. When processing certain malformed image files with the tiffcrop utility, the program performs an out-of-bounds read operation. The issue was discovered through testing with AddressSanitizer, which detected the buffer overflow during memory operations (GitLab Issue).

If a user were tricked into opening a specially crafted image file, an attacker could potentially cause tiffcrop to crash, resulting in a denial of service and limited information disclosure (Ubuntu).

The issue has been fixed in various Linux distributions through security updates. Ubuntu users can update their systems using the command sudo pro fix USN-6428-1. The vulnerability has been addressed in multiple Ubuntu versions including 16.04, 18.04, and 22.04 (Broadcom Support).