CVE-2023-49464: 
NixOS vulnerability analysis and mitigation

A segmentation violation vulnerability was discovered in libheif version 1.17.5 affecting the UncompressedImageCodec::get_luma_bits_per_pixel_from_configuration_unci function (NVD, Ubuntu).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue manifests as a segmentation violation in the UncompressedImageCodec::get_luma_bits_per_pixel_from_configuration_unci function of libheif (NVD).

If exploited, this vulnerability could allow an attacker to cause a program crash resulting in a denial of service. The vulnerability affects applications that process HEIF image files using the affected libheif version (Ubuntu).

The vulnerability can be triggered by processing specially crafted image files. A proof of concept has been published demonstrating heap-use-after-free, segmentation violation, and heap-buffer-overflow variants of the exploit (GitHub Issue).

The issue has been fixed in subsequent releases. Ubuntu 23.10 users should update to libheif version 1.16.2-2ubuntu1.1. Other Ubuntu versions (24.04 LTS, 22.04 LTS, 20.04 LTS, and 18.04 LTS) are not affected by this vulnerability (Ubuntu).