A flaw was found in fig2dev version 3.2.8a. A global buffer overflow in fig2dev/read.c in function readobjects may lead to memory corruption and other potential consequences.
Upstream bug:
https://sourceforge.net/p/mcj/tickets/116/
Upstream fix:
https://sourceforge.net/p/mcj/fig2dev/ci/6827c09d2d6491cb2ae3ac7196439ff3aa791fd9/