CVE-2023-49460: 
NixOS vulnerability analysis and mitigation

A segmentation violation vulnerability was discovered in libheif version 1.17.5, specifically in the UncompressedImageCodec::decode_uncompressed_image function. The vulnerability was disclosed on December 7, 2023, and affects the image processing capabilities of the software (MITRE CVE, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, but does require user interaction. The impact affects confidentiality, integrity, and availability, all with high severity (NVD).

When exploited, this vulnerability can lead to a program crash resulting in a denial of service. The segmentation violation occurs during the processing of specially crafted image files, potentially affecting applications that use the libheif library for image processing (Ubuntu Security).

The vulnerability has been fixed in various distributions. Ubuntu 23.10 has been patched with version 1.16.2-2ubuntu1.1, while other versions like Ubuntu 22.04 LTS, 20.04 LTS, and 18.04 LTS were not affected. Debian has also addressed this in version 1.17.6-1 (Debian Tracker, Ubuntu Security).