CVE-2023-2731: 
NixOS vulnerability analysis and mitigation

A NULL pointer dereference vulnerability (CVE-2023-2731) was discovered in Libtiff's LZWDecode() function within the libtiff/tif_lzw.c file. The vulnerability was reported on May 17, 2023, affecting Libtiff versions prior to 4.5.0. This security flaw impacts various operating systems and distributions including Red Hat Enterprise Linux and Fedora (NVD, CVE).

The vulnerability occurs in the LZWDecode() function when processing TIFF format files. When decompressing a TIFF file, the function can attempt to dereference a NULL pointer due to improper handling of specific input data. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

When successfully exploited, this vulnerability can result in a program crash or denial of service (DoS) condition. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (NetApp Advisory).

The vulnerability requires local access and user interaction to exploit. An attacker can trigger the vulnerability by crafting specific input data that causes the program to dereference a NULL pointer when decompressing a TIFF format file. The issue has been demonstrated using the tiffcp utility with specially crafted TIFF files (GitLab Issue).

The vulnerability has been fixed in Libtiff version 4.5.0. A patch was committed to address the issue, preventing crashes when attempting to read from a strip with a missing end-of-information marker (GitHub Patch). Users are advised to upgrade to the patched version to mitigate this vulnerability.