CVE-2020-24994: 
NixOS vulnerability analysis and mitigation

CVE-2020-24994 is a security vulnerability discovered in libass, affecting versions before 0.15.0. The vulnerability was identified in the parse_tag function within libass/ass_parse.c, which was disclosed and documented on March 23, 2021 (NVD).

The vulnerability is a stack overflow condition in the parse_tag function in libass/ass_parse.c. The issue occurs due to improper handling of deeply nested tags, particularly in the parsing of ASS subtitle files. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

When exploited, this vulnerability can allow remote attackers to cause a denial of service condition or potentially execute remote code through a specially crafted file. The high severity score indicates significant potential impact on system confidentiality, integrity, and availability (NVD).

The vulnerability can be triggered by processing a maliciously crafted file containing deeply nested tags. The exploit requires user interaction to process the malicious file, but no special privileges are needed. The vulnerability was demonstrated through a proof-of-concept that caused a stack overflow through recursive parsing of nested tags (GitHub Issue).

The vulnerability was fixed in libass version 0.15.0. The fix involved restructuring the parse_tag function to handle nested tags without recursion, preventing the stack overflow condition. Users are advised to upgrade to version 0.15.0 or later to mitigate this vulnerability (GitHub Patch).