CVE-2023-50671: 
NixOS vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability exists in exiftags version 1.01, specifically in the nikon_prop1 function within nikon.c. The vulnerability (CVE-2023-50671) was discovered in December 2023 and affects the image metadata parsing functionality. The issue occurs because the snprintf function can write to an unexpected address, potentially leading to memory corruption (Yulun Blog, NVD).

The vulnerability is caused by improper buffer size handling in the nikon_prop1 function where snprintf can write beyond the allocated buffer size of 21 bytes, resulting in a heap buffer overflow of 28 bytes. The issue has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-787 (Out-of-bounds Write) (NVD).

The vulnerability can lead to heap memory corruption when processing specially crafted JPEG files containing malicious Exif metadata. This could potentially result in arbitrary code execution, information disclosure, or application crashes. The high CVSS score indicates severe potential impacts on the confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability affects exiftags version 1.01, which is the latest released version of the software. As of now, there is no official patch available for this vulnerability. Users are advised to exercise caution when processing untrusted JPEG files with exiftags until a fix is released (Product Page).