PT-2021-6723 · Fig2Dev+3 · Fig2Dev+3
Suhwan Song
·
Published
2021-08-10
·
Updated
2025-06-23
·
CVE-2020-21682
CVSS v2.0
7.1
High
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
fig2dev version 3.2.7b
Description
A global buffer overflow in the
set fill component in genge.c of fig2dev allows attackers to cause a denial of service (DOS) via converting a xfig file into ge format. This issue is related to the lack of input validation when copying data to a buffer, which can be exploited by a remote attacker.Recommendations
For fig2dev version 3.2.7b, consider disabling the
set fill component in genge.c as a temporary workaround to prevent exploitation until a patch is available. Restrict access to the genge.c module to minimize the risk of denial of service attacks. Avoid converting xfig files to ge format using the affected version of fig2dev until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Suse
Ubuntu
Fig2Dev