Double-Free Vulnerability in fig2dev Package Could Lead to Denial of Service
Summary
UBUNTU-CVE-2021-37529: A double-free vulnerability exists in fig2dev through 3.28a is affected by: via the free_stream function in readpics.c, which could cause a denial of service (context-dependent). Affects fig2dev versions < 1:3.2.8b-1. Fixed in 1:3.2.8b-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The fig2dev package is a utility that converts figures from various formats into device-independent formats. It is widely used in graphic design and scientific publishing for its ability to handle complex graphics. However, versions of fig2dev prior to 3.2.9a are susceptible to a double-free vulnerability, which can compromise the stability of applications relying on this package.
Vulnerability Detail
A double-free vulnerability exists in fig2dev through version 3.2.8a, specifically in the free_stream function located in readpics.c. This flaw can lead to a denial of service, as it allows an attacker to manipulate memory management, potentially crashing the application or causing unpredictable behavior. The vulnerability is context-dependent, meaning its impact can vary based on how the application is used.
How To Fix
Minimum fixed version
1:3.2.8b-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade fig2devTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider temporarily disabling the use of fig2dev in your applications until the package can be updated. Additionally, review your application’s usage of fig2dev to identify any potential risks associated with the vulnerability.
Conclusion
The double-free vulnerability in the fig2dev package poses a significant risk to applications that rely on it. By updating to the latest patched versions, users can mitigate this risk and ensure the stability of their applications. Regular monitoring for vulnerabilities is also recommended to maintain security.
See every vulnerability recorded for fig2dev →
FAQ
A double-free vulnerability occurs when a program attempts to free the same memory location more than once, which can lead to memory corruption and unpredictable behavior.
Exploiting this vulnerability can lead to a denial of service, causing your application to crash or behave erratically, which may disrupt user experience.
If you are using fig2dev versions prior to 1:3.2.9-3, your application is at risk. It is recommended to check your installed version and update if necessary.
If you cannot update the package right away, consider disabling its use in your applications and monitoring for any unusual behavior.
You can use tools like Vulert, which allows you to monitor and alert for open-source vulnerabilities in real-time using a manifest file like package-lock.json. You can also check your application for vulnerabilities using the Vulert playground without signing up.
References
Related vulnerabilities
Recent vulnerabilities recorded for fig2dev.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
