CVE-2022-37051: 
NixOS vulnerability analysis and mitigation

CVE-2022-37051 is a vulnerability discovered in Poppler 22.07.0, a PDF rendering library. The vulnerability involves a reachable abort condition that leads to denial of service, specifically occurring because the main function in pdfunite.cc lacks a stream check before saving an embedded file (NVD).

The vulnerability is classified with a CVSS v3.1 Base Score of 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The technical root cause involves a missing validation check in the Object::getDict function, which can trigger a SIGABRT at poppler/Object.h:435 when processing certain PDF files (Gitlab Issue).

When exploited, this vulnerability can cause a denial of service condition through an application crash. The impact is primarily on availability, with no direct effect on confidentiality or integrity of the system (Ubuntu Security).

The vulnerability has been fixed in various distributions through security updates. Ubuntu has released fixes in versions 22.02.0-2ubuntu0.3 for Ubuntu 22.04 LTS, 0.86.1-0ubuntu1.4 for Ubuntu 20.04 LTS, and other versions for older releases. Debian has also addressed this in version 0.71.0-5+deb10u3 (Ubuntu Notice, Debian LTS).