CVE-2023-23082: 
NixOS vulnerability analysis and mitigation

A heap buffer overflow vulnerability was discovered in Kodi Home Theater Software versions up to 19.5. The vulnerability, identified as CVE-2023-23082, was caused by an improper length of the value passed to the offset argument when parsing EXIF information in image files (NVD).

The vulnerability is classified as a heap buffer overflow (CWE-787: Out-of-bounds Write) with a CVSS v3.1 Base Score of 4.6 (MEDIUM). The vulnerability occurs in the EXIF parsing functionality when processing image files, specifically when handling the offset argument. The issue involves improper validation of buffer boundaries during EXIF data processing (NVD, GitHub PR).

When exploited, this vulnerability can allow attackers to cause a denial of service condition in the Kodi application. The impact is limited to availability, with no direct impact on confidentiality or integrity of the system (NVD).

The vulnerability requires physical access to exploit (AV:P) with low attack complexity (AC:L) and no privileges required (PR:N). A proof-of-concept exploit was documented in the issue tracker demonstrating how malformed image files could trigger the vulnerability (GitHub Issue).

The vulnerability has been fixed in subsequent releases of Kodi. The fix includes proper boundary checks for EXIF data processing and validation of offset values. The patches were backported from upstream fixes in the jhead project (GitHub PR). Debian has also released security updates to address this vulnerability in their distributions (Debian Advisory).