CVE-2020-21683: 
NixOS vulnerability analysis and mitigation

A global buffer overflow vulnerability exists in the shadeortintnameafterdeclarecolor function in genpstricks.c of fig2dev version 3.2.7b. The vulnerability allows attackers to cause a denial of service (DOS) by converting a xfig file into pstricks format (SourceForge Issue, NVD Database).

The vulnerability is classified as a classic buffer overflow (CWE-120) that occurs in the shadeortintnameafterdeclarecolor function at line 1135 of genpstricks.c. It has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating local access, low attack complexity, no privileges required, and user interaction required (NVD Database).

The vulnerability primarily affects the availability of the system, potentially leading to denial of service conditions. When exploited, it can cause the application to crash through a global buffer overflow, disrupting normal operations (NVD Database).

The vulnerability has been fixed in subsequent versions of fig2dev. Users should upgrade to a version newer than 3.2.7b. The fix involves proper handling of tinted default colors in the pstricks output format (SourceForge Issue).