CVE-2023-25221: 
NixOS vulnerability analysis and mitigation

Libde265 v1.0.10 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function in motion.cc. The vulnerability was identified in January 2023 and affects the open H.265 video codec implementation (GitHub Issue, NVD).

The vulnerability is a heap-buffer-overflow that occurs in the derive_spatial_luma_vector_prediction function at motion.cc:1894. The issue involves a READ operation of size 1 at an unauthorized memory location, which can be triggered when processing specially crafted video files (GitHub Issue).

The vulnerability can lead to software crashes, protection mechanism bypasses, memory modifications, and potentially code execution. When exploited, it allows attackers to cause a denial of service or execute arbitrary code if a user or automated system is tricked into opening a specially crafted file (Ubuntu Notice).

The vulnerability can be triggered by processing specially crafted video files. A proof of concept (PoC) has been developed and documented, demonstrating the ability to cause the heap-buffer-overflow through malformed input (GitHub Issue).

The vulnerability has been fixed in multiple distribution releases. Debian has released version 1.0.11-0+deb10u4 for Debian 10, Ubuntu has released updates for versions 22.04 (1.0.8-1ubuntu0.2), 20.04 (1.0.4-1ubuntu0.3), and 18.04 (1.0.2-2ubuntu0.18.04.1~esm3). Users are recommended to upgrade their libde265 packages to the latest available versions (Debian LTS, Ubuntu Notice).