CVE-2021-3500: 
NixOS vulnerability analysis and mitigation

A stack overflow vulnerability was discovered in djvulibre version 3.5.28 and earlier, identified as CVE-2021-3500. The flaw exists in the DJVU::DjVuDocument::get_djvu_file() function, which can be triggered via a crafted djvu file. This vulnerability was reported on April 15, 2021, and was assigned by Red Hat, Inc (Red Hat Bug).

The vulnerability occurs when djvulibre attempts to open a file inside a djvu file while already opening it, creating an infinite recursive loop that results in a stack overflow. The issue was assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-787 (Out-of-bounds Write) (NVD Database).

The exploitation of this vulnerability may lead to application crashes and potentially other severe consequences, including the possibility of arbitrary code execution through crafted DjVu files (Debian Advisory).

The vulnerability requires user interaction to open a specially crafted djvu file. The exploit was discovered by 1vanChen from the NSFOCUS Security Team (Red Hat Bug).

The vulnerability has been fixed in various distributions: Debian Bullseye (version 3.5.28-2), Debian Buster (version 3.5.27.1-10+deb10u1), Ubuntu 21.04 (version 3.5.28-1ubuntu0.1), Ubuntu 20.04 LTS (version 3.5.27.1-14ubuntu0.1), and Ubuntu 18.04 LTS (version 3.5.27.1-8ubuntu0.3). The fix involves implementing a mechanism to remember which file is being opened to prevent the recursive loop (Ubuntu Security).