PT-2017-14628 · Xfig+2 · Xfig+2
Joonun Jang
·
Publicado
2017-11-20
·
Atualizado
2024-06-15
·
CVE-2017-16899
CVSS v3.1
7.1
Alta
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Xfig version 3.2.6a
Description
The issue is related to an array index error in the fig2dev program, which can be exploited by remote attackers using a maliciously crafted Fig format file. This can lead to a denial-of-service attack or information disclosure. The error is specifically related to a negative font value in dev/gentikz.c, and the read textobject functions in read.c and read1 3.c.
Recommendations
For Xfig version 3.2.6a, consider restricting the use of the fig2dev program until a patch is available, and avoid processing untrusted Fig format files to minimize the risk of exploitation.
Correção
DoS
Improper Validation of Array Index
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Suse
Xfig