CVE-2024-7868: 
NixOS vulnerability analysis and mitigation

In Xpdf 4.05 and earlier versions, a security vulnerability has been identified where invalid header information in a DCT (JPEG) stream can lead to an uninitialized variable in the DCT decoder. When exploited, this vulnerability results in a segmentation fault when attempting to read from an invalid address (NVD).

The vulnerability is tracked as CVE-2024-7868 and has been assigned a CVSS v3.1 base score of 8.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. Additionally, it has been assigned a CVSS v4.0 score of 2.1 (LOW) with the vector string CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. The vulnerability specifically affects the DCT decoder component of Xpdf, where improper handling of header information can trigger an uninitialized variable condition (NVD).

When exploited, this vulnerability can cause the application to crash due to a segmentation fault when attempting to access an invalid memory address. This primarily affects the availability of the system, with potential for information disclosure (NVD).

The vulnerability affects Xpdf version 4.05 and earlier versions. Users should upgrade to newer versions when available that address this security issue (NVD).