CVE-2023-51104: 
NixOS vulnerability analysis and mitigation

A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function pnm_binary_read_image() of load-pnm.c when span equals zero. The vulnerability was assigned CVE-2023-51104 and was publicly disclosed in December 2023 (NVD).

The vulnerability exists in the pnm_binary_read_image() function within the load-pnm.c file of MuPDF 1.23.4. The issue occurs when the number of components in the passed colorspace is not properly validated, potentially leading to a division by zero operation. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (NVD).

If exploited, this vulnerability could allow attackers to cause a denial of service condition through a floating point exception (divide-by-zero), potentially crashing the application when processing specially crafted PNM image files (NVD).

The vulnerability has been fixed in a patch that adds an assertion to ensure the number of components is greater than 0. The fix was implemented in commit 0c06a4e51519515615f6ab2d5b1f25da6771e1f4, which adds a redundant assert() for the number of components to prevent division by zero (Ghostscript Commit, Ghostscript Bug).