CVE-2020-35450: 
NixOS vulnerability analysis and mitigation

Gobby 0.4.11 contains a NULL pointer dereference vulnerability in the D-Bus handler for certain set_language calls. The vulnerability was discovered and disclosed in December 2020, identified as CVE-2020-35450. This security flaw affects Gobby version 0.4.11 and potentially earlier versions (NVD, CVE).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476). It received a CVSS v3.1 Base Score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue occurs specifically when attempting to make D-Bus calls when no document is open in the application, leading to a NULL pointer dereference in the TextSessionView::set_language function (GitHub PR).

The vulnerability can lead to a denial of service condition when exploited. When triggered, it causes the application to crash due to the NULL pointer dereference, affecting the availability of the service (NVD).

The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction. The attack vector is network-based, making it accessible to remote attackers (NVD).

A fix was implemented through GitHub pull request #184, which adds proper error handling when no current view exists instead of crashing. The fix was merged into the main branch and is available in newer versions of Gobby. Users are advised to upgrade to a patched version (GitHub PR).