CVE-2024-25450: 
NixOS vulnerability analysis and mitigation

imlib2 v1.9.1 contains a vulnerability related to memory allocation mishandling in the function init_imlib_fonts(). The vulnerability was discovered and reported in February 2024, affecting the Imlib2 library, which is a graphics library for image loading and manipulation (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue specifically involves improper handling of memory allocation in the init_imlib_fonts() function, which can lead to security implications (NVD).

Based on the CVSS score and vector, the vulnerability can potentially lead to high impacts on confidentiality, integrity, and availability of the affected systems when successfully exploited. The vulnerability requires user interaction but can be exploited remotely without authentication (NVD).

The vulnerability has been fixed in several versions across different distributions. Debian has addressed this in bullseye (1.7.1-2+deb11u1), bookworm (1.10.0-4+deb12u1), and sid/trixie (1.12.3-2). Users are advised to upgrade to the fixed versions (Debian Tracker).