CVE-2023-46009: 
NixOS vulnerability analysis and mitigation

A floating point exception (FPE) vulnerability was discovered in gifsicle version 1.94 via the resize_stream function in src/xform.c. The vulnerability was identified on October 10, 2023, and affects the image manipulation functionality of the software (GitHub Issue).

The vulnerability occurs in the resize_stream function located in src/xform.c at line 1327. When specific command-line parameters are used for image manipulation operations like cropping, flipping, rotating, and resizing, it can trigger a floating point exception. The issue has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

When exploited, the vulnerability causes the application to crash due to a floating point exception, leading to a denial of service condition. This can affect systems that rely on gifsicle for automated GIF image processing (GitHub Issue).

The vulnerability has been fixed in gifsicle version 1.95. Users are advised to upgrade to this version. The fix has been packaged and distributed through various Linux distributions, including Fedora 38 and 39 (Fedora Update).