CVE-2023-49463: 
NixOS vulnerability analysis and mitigation

CVE-2023-49463 is a vulnerability discovered in libheif version 1.17.5, a library for HEIF and AVIF file format decoding and encoding. The vulnerability involves a segmentation violation in the find_exif_tag function located in /libheif/exif.cc (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue specifically occurs in the EXIF tag handling functionality of the library, where improper handling of certain image data can lead to a segmentation fault (NVD, Ubuntu).

When exploited, this vulnerability can cause the program to crash, resulting in a denial of service condition. The high CVSS score indicates potential impacts on confidentiality, integrity, and availability of the system when processing specially crafted files (NVD, Ubuntu Notice).

The vulnerability has been fixed in subsequent releases. Ubuntu has released security updates for affected versions, particularly in Ubuntu 23.10 with package version 1.16.2-2ubuntu1.1. Users are advised to update their systems to the patched versions (Ubuntu Notice).