Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server or window manager.
xfig 3.2.7 is vulnerable to Buffer Overflow.
readtextobject in read.c in Xfig fig2dev 3.2.7b has a stack-based buffer overflow because of an incorrect sscanf.
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the readtextobject functions in read.c and read13.c.
A stack-based buffer overflow flaw was found in the way Xfig processed certain FIG images. A remote attacker could create a FIG image with specially-crafted color definition, and trick the local, unsuspecting user into opening it, which could lead to xfig executable crash or, potentially, arbitrary code execution with the privileges of the user running the executable.
References: [1] https://bugzilla.redhat.com/showbug.cgi?id=657981
Public PoC: [2] https://bugzilla.redhat.com/attachment.cgi?id=463393
Flaw severity note: On systems with compile time buffer checks (FORTIFYSOURCE) feature enabled, the impact of this flaw is mitigated to be only crash.
A stack-based buffer overflow flaw was found in the way Xfig processed certain FIG images. A remote attacker could create a FIG image with specially-crafted color definition, and trick the local, unsuspecting user into opening it, which could lead to xfig executable crash or, potentially, arbitrary code execution with the privileges of the user running the executable.
References: [1] https://bugzilla.redhat.com/showbug.cgi?id=657981
Public PoC: [2] https://bugzilla.redhat.com/attachment.cgi?id=463393
Flaw severity note: On systems with compile time buffer checks (FORTIFYSOURCE) feature enabled, the impact of this flaw is mitigated to be only crash.
PEDAMACHEPHEPTOLIONES and D.B. COOPER found a stack-based buffer overflow, present in Xfig, Transfig by loading malformed .FIG files. A remote attacker could provide a specially-crafted .FIG text object file, which once opened by a local, unsuspecting user would lead to denial of service (Xfig, fig2dev crash).
References: ----------- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559274
Fortran PoC by PEDAMACHEPHEPTOLIONES: ------------------------------------- http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=xfigpoc.f;att=1;bug=559274
CVE was requested here: ----------------------- http://www.openwall.com/lists/oss-security/2009/12/03/2
Stack consumption vulnerability in ubound.c in Xfig 3.2.5b and earlier allows remote attackers to cause a denial of service (application crash) via a long string in a malformed .fig file that uses the 1.3 file format, possibly related to the readfpfig function in fread.c.
PEDAMACHEPHEPTOLIONES and D.B. COOPER found a stack-based buffer overflow, present in Xfig, Transfig by loading malformed .FIG files. A remote attacker could provide a specially-crafted .FIG text object file, which once opened by a local, unsuspecting user would lead to denial of service (Xfig, fig2dev crash).
References: ----------- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559274
Fortran PoC by PEDAMACHEPHEPTOLIONES: ------------------------------------- http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=xfigpoc.f;att=1;bug=559274
CVE was requested here: ----------------------- http://www.openwall.com/lists/oss-security/2009/12/03/2