CVE-2024-53901: 
NixOS vulnerability analysis and mitigation

The Imager package before 1.025 for Perl contains a heap-based buffer overflow vulnerability (CVE-2024-53901). The vulnerability is triggered when the trim() method is called on a crafted input image, which can lead to denial of service or potentially other unspecified impacts. The issue was discovered in November 2024 and fixed in version 1.025 (CPAN Changes).

The vulnerability is classified as a heap-based buffer overflow (CWE-787: Out-of-bounds Write) with a CVSS v3.1 base score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). The issue occurs specifically in the trim() method implementation where a buffer is incorrectly sized, leading to potential memory corruption when processing specially crafted input images (NVD).

The primary confirmed impact is denial of service through application crashes. When exploited, the vulnerability can cause invalid memory operations leading to program termination. There are also potential unspecified additional impacts that have not been fully detailed (NVD).

The vulnerability requires a user to process a specially crafted input image using the trim() method. A proof-of-concept exploit has been documented that demonstrates the buffer overflow condition, resulting in program crashes with various error messages including 'invalid next size' and 'Incorrect checksum for freed object' (GitHub Issue).

The vulnerability has been fixed in Imager version 1.025. Users should upgrade to this version or later to address the issue. The fix involves correcting the buffer sizing in the trim() method implementation (CPAN Changes).