Critical Security Update for fig2dev: Addressing Multiple Vulnerabilities
Summary
DLA-4147-1: fig2dev - security update. Affects fig2dev versions < 1:3.2.8-3+deb11u3. Fixed in 1:3.2.8-3+deb11u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
fig2dev is a utility that converts figures from various formats into device-independent formats, primarily used in scientific and academic settings. It is a part of the Debian ecosystem, specifically designed for Debian 11. This package is essential for users who require high-quality graphics in their documents. However, recent vulnerabilities have been identified that could potentially compromise the integrity and security of systems utilizing this software.
Vulnerability Detail
The vulnerabilities identified in fig2dev, cataloged under CVE-2025-46397, CVE-2025-46398, CVE-2025-46399, and CVE-2025-46400, stem from flaws in the way the software processes certain inputs. These vulnerabilities could allow an attacker to execute arbitrary code, leading to unauthorized access or denial of service. The issues arise from improper validation and handling of user inputs, which can be exploited if not addressed promptly.
How To Fix
Minimum fixed version
1:3.2.8-3+deb11u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade fig2devTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of fig2dev to trusted sources and avoid processing untrusted input files until the package is updated. Additionally, implementing strict input validation in applications that utilize fig2dev can help mitigate potential risks.
Conclusion
In summary, the fig2dev package has been found to contain critical vulnerabilities that could pose significant risks to users. It is crucial to update to the latest patched version to ensure the security and integrity of your systems. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for fig2dev →
FAQ
The vulnerabilities are identified as CVE-2025-46397, CVE-2025-46398, CVE-2025-46399, and CVE-2025-46400, which involve improper input handling leading to potential code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without needing to sign up.
If immediate updates are not possible, consider limiting the use of fig2dev to trusted sources and avoid processing untrusted input files as a temporary workaround.
Detailed information about the vulnerabilities can be found in the CVE entries: CVE-2025-46397, CVE-2025-46398, CVE-2025-46399, and CVE-2025-46400.
No, updating fig2dev to the patched version should not result in data loss. However, it is always advisable to back up important data before performing any updates.
Related vulnerabilities
Recent vulnerabilities recorded for fig2dev.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
