CVE-2023-34293: 
NixOS vulnerability analysis and mitigation

CVE-2023-34293 is a remote code execution vulnerability discovered in Ashlar-Vellum Cobalt software. The vulnerability was disclosed on June 8, 2023, and affects the parsing of X_B or X_T files in the application. The vulnerability has been assigned a CVSS score of 7.0 (ZDI Advisory).

The vulnerability exists within the parsing of X_B or X_T files in Ashlar-Vellum Cobalt. The specific flaw stems from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer, leading to an out-of-bounds write condition. The vulnerability has been assigned a CVSS v3.0 score of 7.0 with the following vector: AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory).

If successfully exploited, this vulnerability allows remote attackers to execute arbitrary code in the context of the current process on affected installations of Ashlar-Vellum Cobalt. However, user interaction is required for exploitation, as the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability has been fixed in Ashlar-Vellum Cobalt version 12.0.1204.54. Users are advised to update to this version or later to mitigate the risk (ZDI Advisory).