CVE-2024-3900: 
NixOS vulnerability analysis and mitigation

An out-of-bounds array write vulnerability was discovered in Xpdf version 4.05 and earlier versions. The vulnerability is triggered by a long Unicode sequence in ActualText. This security issue was initially reported on April 17, 2024, and was assigned the identifier CVE-2024-3900 (NVD).

The vulnerability is classified as an Out-of-bounds Write (CWE-787) issue. According to the National Vulnerability Database, it has received a CVSS v3.1 base score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H from NIST, while the vendor Glyph & Cog, LLC assigned a lower score of 2.9 (LOW) with the vector string CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (NVD).

The vulnerability affects the availability of the system, as indicated by the CVSS metrics. The impact is primarily focused on system availability rather than confidentiality or integrity, as shown by the presence of 'A:H' (High availability impact) in the CVSS vector string (NVD).

The vulnerability requires local access (AV:L) with low attack complexity (AC:L) and low privileges (PR:L) to exploit, according to the NIST assessment. No user interaction (UI:N) is required for exploitation (NVD).

Users should upgrade to a version newer than Xpdf 4.05 once available, or implement appropriate access controls to limit local access to the affected systems (NVD).