CVE-2023-49463: 
NixOS vulnerability analysis and mitigation

CVE-2023-49463 is a vulnerability discovered in libheif version 1.17.5, a library for HEIF and AVIF file format decoding and encoding. The vulnerability involves a segmentation violation in the find_exif_tag function located in /libheif/exif.cc (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue specifically occurs in the EXIF tag handling functionality of the library, where improper handling of certain image data can lead to a segmentation fault (NVD, Ubuntu).

When exploited, this vulnerability can cause the program to crash, resulting in a denial of service condition. The high CVSS score indicates potential impacts on confidentiality, integrity, and availability of the system when processing specially crafted files (NVD, Ubuntu Notice).

The vulnerability requires user interaction to process a specially crafted file. The issue was discovered and reported by Yuchuan Meng from Fudan University, who provided a proof of concept demonstrating the segmentation violation (GitHub Issue).

The vulnerability has been fixed in subsequent releases. Ubuntu has released security updates for affected versions, particularly in Ubuntu 23.10 with package version 1.16.2-2ubuntu1.1. Users are advised to update their systems to the patched versions (Ubuntu Notice).