PT-2021-5755 · Fig2Dev+4 · Fig2Dev+4

Shanzhuli · Published 2021-04-19 · Updated 2024-06-15 · CVE-2021-3561

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions fig2dev version 3.2.8a

Description A flaw was found in the read objects() function of fig2dev, related to an out of bounds operation in memory. This could allow an attacker to provide crafted malicious input, causing the application to crash or potentially leading to memory corruption. The highest threat from this issue is to data integrity and system availability.

Recommendations For fig2dev version 3.2.8a, consider disabling the read objects() function as a temporary workaround until a patch is available. Restrict access to potentially vulnerable areas of the application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

BDU:2022-00200

CVE-2021-3561

DLA-2778-1

MGASA-2021-0379

OPENSUSE-SU-2021:1143-1

OPENSUSE-SU-2021:1311-1

OPENSUSE-SU-2021:1318-1

OPENSUSE-SU-2021:2454-1

OPENSUSE-SU-2021_1143-1

OPENSUSE-SU-2021_2454-1

OPENSUSE-SU-2024:11472-1

SUSE-SU-2021:14823-1

SUSE-SU-2021:2454-1

SUSE-SU-2021:3124-1

SUSE-SU-2021_14823-1

USN-5864-1

Affected Products

Astra Linux

Linuxmint

Suse

Ubuntu

Fig2Dev

References · 74

• 🔥 https://sourceforge.net/p/mcj/tickets/116 · Exploit
• https://ubuntu.com/security/CVE-2021-32280 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5864-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1318-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:14823-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00200 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C44WSY5KAQXC3Y2NMSVXXZS3M5U5U2E6 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1955675 · Patch
• https://cve.org/CVERecord?id=CVE-2021-3561 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/C44WSY5KAQXC3Y2NMSVXXZS3M5U5U2E6 · Vendor Advisory
• https://sourceforge.net/p/mcj/fig2dev/ci/6827c09d2d6491cb2ae3ac7196439ff3aa791fd9 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2021:1311-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1143-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:3124-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3561 · Vendor Advisory