CVE-2023-1916: 
NixOS vulnerability analysis and mitigation

A flaw was found in tiffcrop, a program distributed by the libtiff package. The vulnerability (CVE-2023-1916) was discovered in April 2023 and affects libtiff versions 4.x. A specially crafted TIFF file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c (NVD, Ubuntu).

The vulnerability is a heap-buffer-overflow that occurs in the extractImageSection function in tools/tiffcrop.c, specifically at line 7847. When processing certain malformed image files with the tiffcrop utility, the program performs an out-of-bounds read operation. The issue was discovered through testing with AddressSanitizer, which detected the buffer overflow during memory operations (GitLab Issue).

If a user were tricked into opening a specially crafted image file, an attacker could potentially cause tiffcrop to crash, resulting in a denial of service and limited information disclosure (Ubuntu).

The vulnerability requires user interaction to open a maliciously crafted TIFF file. The security impact is considered low as it affects only a command-line tool (Ubuntu).

The issue has been fixed in various Linux distributions through security updates. Ubuntu users can update their systems using the command sudo pro fix USN-6428-1. The vulnerability has been addressed in multiple Ubuntu versions including 16.04, 18.04, and 22.04 (Broadcom Support).