REDHAT-BUG-543905: Medium severity xfig vulnerability

Published Dec 3, 2009

Updated

PEDAMACHEPHEPTOLIONES and D.B. COOPER found a stack-based buffer overflow, present in Xfig, Transfig by loading malformed .FIG files. A remote attacker could provide a specially-crafted .FIG text object file, which once opened by a local, unsuspecting user would lead to denial of service (Xfig, fig2dev crash).

References: ----------- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559274

Fortran PoC by PEDAMACHEPHEPTOLIONES: ------------------------------------- http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=xfigpoc.f;att=1;bug=559274

CVE was requested here: ----------------------- http://www.openwall.com/lists/oss-security/2009/12/03/2

Affected Software

2 affected components

Xfig Xfig

Transfig Transfig

Event History

Dec 3, 2009

Data Sourced

via Red Hat·01:25 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-543905?

REDHAT-BUG-543905 is classified as a high severity vulnerability due to the potential for a remote attacker to exploit it.

How do I fix REDHAT-BUG-543905?

To fix REDHAT-BUG-543905, you should update Xfig and Transfig to the latest patched versions provided by the vendor.

What systems are affected by REDHAT-BUG-543905?

The affected systems by REDHAT-BUG-543905 include Xfig and Transfig.

What kind of attack is associated with REDHAT-BUG-543905?

REDHAT-BUG-543905 is associated with a stack-based buffer overflow attack that can lead to a denial of service.

Can REDHAT-BUG-543905 be exploited remotely?

Yes, REDHAT-BUG-543905 can be exploited remotely by tricking a user into opening a malicious .FIG file.