CVE-2023-26590: 
NixOS vulnerability analysis and mitigation

A floating point exception vulnerability was discovered in SoX (Sound eXchange) version 14.4.3, specifically in the lsx_aiffstartwrite function located at sox/src/aiff.c:622:58. The vulnerability was assigned CVE-2023-26590 and was publicly disclosed on July 10, 2023. The issue affects various Linux distributions including Red Hat Enterprise Linux, Fedora, and Ubuntu systems (NVD, CVE).

The vulnerability is classified with a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The issue is related to incorrect floating point comparison operations and has been categorized under CWE-697 (Incorrect Comparison) and CWE-1077 (Floating Point Comparison with Incorrect Operator) (NVD).

When exploited, this vulnerability can lead to a denial of service condition in the affected systems. The impact is primarily focused on availability, with no direct effect on confidentiality or integrity of the system (Ubuntu, NVD).

The vulnerability requires local access with low attack complexity and low privileges to exploit. No user interaction is needed for exploitation (NVD).

Multiple Linux distributions have released fixes for this vulnerability. Ubuntu has patched various versions including 22.04 LTS (14.4.2+git20190427-2+deb11u1build0.22.04.1) and 20.04 LTS (14.4.2+git20190427-2+deb11u1build0.20.04.1). Debian has also released fixes for bullseye, bookworm, and sid distributions (Ubuntu, Debian).