CVE-2023-31556: 
NixOS vulnerability analysis and mitigation

CVE-2023-31556 affects podofoinfo version 0.10.0, where a segmentation violation was discovered in the function PoDoFo::PdfDictionary::findKeyParent. The vulnerability was identified and disclosed in April 2023 (GitHub Issue).

The vulnerability manifests as a stack overflow condition in the PoDoFo::PdfDictionary::findKeyParent function. The issue occurs due to uncontrolled recursive calls within the function, leading to stack exhaustion. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 MEDIUM by NVD and 8.8 HIGH by CISA-ADP (NVD).

When exploited, this vulnerability can cause a segmentation violation in the affected application, potentially leading to application crashes and denial of service conditions. The stack overflow vulnerability could potentially be exploited to cause program termination or unpredictable behavior (GitHub Issue).

The vulnerability can be triggered through specially crafted PDF files that cause recursive calls to the findKeyParent function. A proof of concept has been documented that demonstrates the stack overflow condition using the podofopdfinfo utility (GitHub Issue).

The vulnerability has been fixed in subsequent releases. Users are advised to update to the latest version of the software. Several Linux distributions including Debian have marked this vulnerability as fixed in their package repositories (Debian Tracker).