CVE-2024-25443: 
NixOS vulnerability analysis and mitigation

An issue in the HuginBase::ImageVariable::linkWith function of Hugin v2022.0.0 allows attackers to cause a heap-use-after-free via parsing a crafted image. The vulnerability was discovered in June 2023 and was assigned CVE-2024-25443 in February 2024. The vulnerability affects Hugin version 2022.0.0 and was fixed in version 2024.0.1 (NVD, Debian Tracker).

The vulnerability is a heap-use-after-free issue that occurs in the HuginBase::ImageVariable::linkWith function when parsing crafted images. The CVSS v3.1 base score is 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-416 (Use After Free) (NVD, Launchpad Bug).

The vulnerability allows attackers to potentially execute arbitrary code or cause program crashes through heap memory manipulation when processing specially crafted images. The high CVSS score indicates potential severe impacts on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires local access and user interaction to exploit, as indicated by the CVSS vector. A proof-of-concept exploit has been documented in the bug report, demonstrating the heap-use-after-free condition when processing specially crafted input files (Launchpad Bug).

The vulnerability has been fixed in Hugin version 2024.0.1. Users are advised to upgrade to this version or later. The fix was initially committed in version 2023.0beta1. Fedora has also released security updates to address this vulnerability (Debian Tracker, Fedora Update).