CVE-2020-18839: 
NixOS vulnerability analysis and mitigation

Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 was discovered, allowing attackers to cause a denial of service. The vulnerability was assigned CVE-2020-18839 and was later confirmed to be a duplicate of CVE-2020-27778. The issue was discovered in August 2020 and received a CVSS v3.1 base score of 6.5 (Medium) (NVD).

The vulnerability exists in the HtmlOutputDev::page component of poppler version 0.75.0. It has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The vulnerability can be triggered through network access, requires low attack complexity, needs no privileges, but does require user interaction. The scope is unchanged, with no impact on confidentiality or integrity, but high impact on availability (NVD).

When successfully exploited, this vulnerability can lead to a denial of service condition in the affected poppler installations. The impact is primarily focused on system availability, with no direct effect on confidentiality or integrity of the system (NVD).

The vulnerability was fixed in poppler version 0.76.0 through commit 30c731b487190c02afff3f036736a392eb60cd9a. Users are advised to upgrade to this or later versions to mitigate the vulnerability (Debian Tracker).