PT-2021-6544 · Fig2Dev+3 · Fig2Dev+3

Suhwan Song · Published 2021-08-10 · Updated 2025-06-23 · CVE-2020-21683

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions fig2dev version 3.2.7b

Description A global buffer overflow in the shade or tint name after declare color function in genpstricks.c allows attackers to cause a denial of service (DOS) via converting a xfig file into pstricks format. The issue is related to copying a buffer without checking the input data, which can be exploited by a remote attacker.

Recommendations For fig2dev version 3.2.7b, consider disabling the shade or tint name after declare color function until a patch is available to prevent the buffer overflow. Restrict the conversion of xfig files to pstricks format to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2022-01805

CVE-2020-21683

OPENSUSE-SU-2021:1439-1

OPENSUSE-SU-2021:1458-1

OPENSUSE-SU-2021:1481-1

OPENSUSE-SU-2021:3584-1

OPENSUSE-SU-2021_1439-1

OPENSUSE-SU-2021_3584-1

OPENSUSE-SU-2024:11472-1

SUSE-SU-2021:14823-1

SUSE-SU-2021:3124-1

SUSE-SU-2021:3584-1

SUSE-SU-2021_14823-1

USN-7587-1

Affected Products

Linuxmint

Suse

Ubuntu

Fig2Dev

References · 71

• 🔥 https://sourceforge.net/p/mcj/tickets/77 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2021:3584-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1458-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:14823-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-31162 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-21680 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-21683 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7587-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-21683 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-21683 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-21683 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:3124-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1439-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01805 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-21683 · Vendor Advisory