CVE-2020-18971: 
NixOS vulnerability analysis and mitigation

Stack-based Buffer Overflow vulnerability (CVE-2020-18971) was discovered in PoDoFo version 0.9.6. The vulnerability exists in the component 'src/base/PdfDictionary.cpp:65' and was caused by excessive recursion in a PdfOutlineItem constructor (NVD, SourceForge Issue).

The vulnerability occurs due to recursive outline structure in PDF files, leading to infinite recursion in the PdfOutlineItem constructor. The issue manifests when following the /Next chain, which creates a circular reference loop (e.g., from object 16 to 19, 21, 20, and back to 16), causing stack overflow. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD, SourceForge Issue).

When exploited, this vulnerability allows attackers to cause a denial of service condition through a specially crafted PDF file. The attack requires user interaction to open the malicious PDF file (NVD, Ubuntu Notice).

The vulnerability affects multiple versions of Ubuntu (14.04 through 22.04) and requires system updates to patch. Ubuntu has released security updates to address this issue in various package versions, including libpodofo-utils and libpodofo packages (Ubuntu Notice).