CVE-2023-49555: 
NixOS vulnerability analysis and mitigation

CVE-2023-49555 affects YASM version 1.3.0.86.g9def, discovered and disclosed in January 2024. This vulnerability allows a remote attacker to cause a denial of service through the expand_smacro function located in the modules/preprocs/nasm/nasm-pp.c component (NVD, GitHub Issue).

The vulnerability is a segmentation violation that occurs in the expand_smacro function at line 4357 of modules/preprocs/nasm/nasm-pp.c. The CVSS v3.1 base score is 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating local access is required but no privileges are needed (NVD).

When successfully exploited, the vulnerability results in a denial of service condition through a segmentation fault, potentially causing the application to crash. The vulnerability affects the availability of the system but does not impact confidentiality or integrity (GitHub Issue).

The vulnerability affects YASM version 1.3.0.86.g9def, and all versions of the package in Debian distributions (bullseye, bookworm, trixie, sid) are marked as vulnerable (Debian Tracker). No official patch or mitigation has been publicly announced at the time of this report.