CVE-2023-31566: 
NixOS vulnerability analysis and mitigation

Podofo v0.10.0 was discovered to contain a heap-use-after-free vulnerability in the component PoDoFo::PdfEncrypt::IsMetadataEncrypted(). The vulnerability was identified and disclosed in April 2023, affecting the PDF manipulation library PoDoFo (GitHub Issue).

The vulnerability is a heap-use-after-free issue that occurs in the PdfEncrypt::IsMetadataEncrypted() function, specifically at main/PdfEncrypt.h:352:47. The issue manifests when attempting to access memory that has been previously freed, which can lead to program crashes or potential security implications. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The vulnerability could potentially lead to program crashes, memory corruption, or possible code execution. Given its CVSS score of 8.8 (HIGH), it represents a significant security risk with potential for high impacts on confidentiality, integrity, and availability of the affected systems (NVD).

As this is a vulnerability in version 0.10.0 of PoDoFo, users should update to a patched version when available. No official patch has been explicitly mentioned in the available sources.