A flaw was found in Dia's Network Bus object loader. When opening a crafted Dia project (.dia) file, the bushandles attribute supplies numhandles without validation. Later, when a bus handle is moved, bushandlemoved() allocates two arrays on the stack using galloca() sized by numhandles, which can exhaust the thread stack and cause memory corruption, application crash, or potentially arbitrary code execution. The same galloca pattern exists in objects/Misc/tree.c.

A flaw was found in Dia's WPG (WordPerfect Graphics) import plugin. When parsing a WPG COLORMAP record, the colormap start index and entry count taken from the file are not validated against the fixed 256-entry palette buffer. A crafted WPG file can cause a heap-based buffer overflow in plug-ins/wpg/wpg-import.c, leading to memory corruption, application crash, and potentially arbitrary code execution if a victim opens the malicious file in Dia. Upstream GitLab issue #580 was closed without a fix.

A flaw was found in Dia's WPG (WordPerfect Graphics) import plugin. When parsing a WPG COLORMAP record, the colormap start index and entry count taken from the file are not validated against the fixed 256-entry palette buffer. A crafted WPG file can cause a heap-based buffer overflow in plug-ins/wpg/wpg-import.c, leading to memory corruption, application crash, and potentially arbitrary code execution if a victim opens the malicious file in Dia. Upstream GitLab issue #580 was closed without a fix.

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.

Untrusted search path vulnerability in dia's Python plug-in alows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySysSetArgv function.

References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504251

Test case and more discussion about this issue (and reason's why it can't be fixed in Python is available at): http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html

Proposed patch: http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=pythonpath.diff;att=1;bug=504251