PT-2021-6724 · Fig2Dev · Fig2Dev

Suhwan Song · Published 2021-08-10 · Updated 2022-12-07 · CVE-2020-21684

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions fig2dev version 3.2.7b

Description The issue is related to a global buffer overflow in the put font function of the genpict2e.c component in the fig2dev utility. This occurs when converting a xfig file into pict2e format without proper input validation, allowing a remote attacker to cause a denial of service (DOS).

Recommendations For fig2dev version 3.2.7b, consider disabling the put font function in genpict2e.c until a patch is available to prevent exploitation. Restrict the conversion of xfig files to pict2e format to minimize the risk of a denial of service attack.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2022-02094

CVE-2020-21684

Affected Products

Fig2Dev

References · 12

• 🔥 https://sourceforge.net/p/mcj/tickets/75 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-21684 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-21684 · Security Note
• https://osv.dev/vulnerability/CVE-2020-21684 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02094 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-21684 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-21684 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-21684 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-21684 · Vendor Advisory
• https://t.me/cvenotify/19416 · Telegram Post
• https://t.me/cibsecurity/27097 · Telegram Post
• https://sourceforge.net/p/mcj/fig2dev/ci/d70e4ba6308046f71cb51f67db8412155af52411 · Note