CVE-2023-36183: 
NixOS vulnerability analysis and mitigation

A Buffer Overflow vulnerability was discovered in OpenImageIO version 2.4.12.0 and earlier versions that allows remote attackers to execute arbitrary code and obtain sensitive information via a crafted file to the readimg function (NVD). The vulnerability was identified in June 2023 and assigned CVE-2023-36183.

The vulnerability is a heap-buffer-overflow that occurs in the ICOInput::readimg function located in src/ico.imageio/icoinput.cpp. The issue has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access is required but no privileges are needed (NVD, GitHub Issue).

When successfully exploited, this vulnerability can lead to arbitrary code execution and unauthorized access to sensitive information. The high CVSS score reflects the severe potential impact on system confidentiality, integrity, and availability (NVD).

The vulnerability has been fixed in OpenImageIO version 2.4.13.0 and later. Various Linux distributions have released security updates to address this vulnerability, including Debian with version 2.0.5~dfsg0-1+deb10u2 and Fedora with version 2.4.14.0 (Debian Advisory, Fedora Advisory).