CVE-2021-39590: 
NixOS vulnerability analysis and mitigation

A NULL pointer dereference vulnerability was discovered in swftools through version 20200710. The vulnerability exists in the params_dump() function located in abc.c, which allows attackers to cause a Denial of Service condition (NVD, GitHub Issue).

The vulnerability is tracked as CVE-2021-39590 and has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The issue occurs when the params_dump() function in abc.c attempts to dereference a NULL pointer at line 58, leading to a segmentation fault (NVD).

When successfully exploited, this vulnerability can cause a denial of service condition by crashing the application through a segmentation fault. The impact is limited to availability, with no direct impact on confidentiality or integrity of the system (NVD).

The vulnerability requires local access and user interaction to exploit. A proof-of-concept exploit has been published demonstrating the NULL pointer dereference through the swfdump utility with specific input (GitHub Issue).

Users should upgrade to a version newer than 20200710 if available. No specific workarounds have been published for this vulnerability (NVD).