PEDAMACHEPHEPTOLIONES and D.B. COOPER found a stack-based buffer overflow, present in Xfig, Transfig by loading malformed .FIG files. A remote attacker could provide a specially-crafted .FIG text object file, which once opened by a local, unsuspecting user would lead to denial of service (Xfig, fig2dev crash).

References: ----------- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559274

Fortran PoC by PEDAMACHEPHEPTOLIONES: ------------------------------------- http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=xfigpoc.f;att=1;bug=559274

CVE was requested here: ----------------------- http://www.openwall.com/lists/oss-security/2009/12/03/2

A stack-based buffer overflow flaw was found in the way Xfig processed certain FIG images. A remote attacker could create a FIG image with specially-crafted color definition, and trick the local, unsuspecting user into opening it, which could lead to xfig executable crash or, potentially, arbitrary code execution with the privileges of the user running the executable.

References: [1] https://bugzilla.redhat.com/showbug.cgi?id=657981

Public PoC: [2] https://bugzilla.redhat.com/attachment.cgi?id=463393

Flaw severity note: On systems with compile time buffer checks (FORTIFYSOURCE) feature enabled, the impact of this flaw is mitigated to be only crash.

Stack consumption vulnerability in ubound.c in Xfig 3.2.5b and earlier allows remote attackers to cause a denial of service (application crash) via a long string in a malformed .fig file that uses the 1.3 file format, possibly related to the readfpfig function in fread.c.