CVE-2021-32434: 
NixOS vulnerability analysis and mitigation

abcm2ps version 8.14.11 was discovered to contain an out-of-bounds read vulnerability in the function calculate_beam at draw.c. The vulnerability was identified in April 2021 and affects the software which translates ABC music description files to PostScript (CVE Details, GitHub Issue).

The vulnerability occurs in the calculatebeam function within draw.c where there is an out-of-bounds read in array mintb at lines 357 and 359. The flaw is triggered when (unsigned) s->nflags is not properly checked to ensure it falls between 0 and 5, leading to an array overflow condition when wrong duration occurs in voice overlay (GitHub Issue).

The vulnerability can cause the application to crash, resulting in a denial of service condition. When exploited, the out-of-bounds read can lead to program termination, affecting the availability of the abcm2ps service (Ubuntu Notice).

The vulnerability has been fixed in version 8.14.13-1 and later releases. Various distributions have released security updates to address this issue: Debian 9 stretch has been fixed in version 7.8.9-1+deb9u1, and Fedora has released version 8.14.13-1 for affected versions (Debian LTS, Fedora Update).