Stack-based Buffer Overflow in Xfig fig2dev 3.2.7a
Summary
CVE-2019-14275: Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the calc_arrow function in bound.c. Affects fig2dev versions < 1:3.2.7a-7. Fixed in 1:3.2.7a-7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Xfig fig2dev is a package used for converting Xfig files to other formats. It is commonly used for generating diagrams and illustrations. The package is vulnerable to a stack-based buffer overflow in the calc_arrow function in bound.c.
Vulnerability Detail
The vulnerability in Xfig fig2dev 3.2.7a arises from a stack-based buffer overflow in the calc_arrow function in bound.c. This can be exploited by an attacker to execute arbitrary code or cause a denial of service. The vulnerability has a CVSS score of 5.5, indicating a moderate severity.
How To Fix
Minimum fixed version
1:3.2.7a-7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade fig2devTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
Xfig fig2dev 3.2.7a is vulnerable to a stack-based buffer overflow. To mitigate this vulnerability, it is recommended to update the fig2dev package to version 1:3.2.7a-7 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for fig2dev →
FAQ
Xfig fig2dev is a package used for converting Xfig files to other formats, commonly used for generating diagrams and illustrations.
The vulnerability allows an attacker to execute arbitrary code or cause a denial of service.
The CVSS score of this vulnerability is 5.5, indicating a moderate severity.
To fix the vulnerability, update the fig2dev package to version 1:3.2.7a-7 or later.
No workaround has been provided for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for fig2dev.
