See how fig2dev project compares to other vendors in security performance
A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezierspline function.
A buffer underwrite vulnerability in getline() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer via a crafted .fig file.
A flaw was found in fig2dev version 3.2.8a. A global buffer overflow in fig2dev/read.c in function readobjects may lead to memory corruption and other potential consequences.
Upstream bug:
https://sourceforge.net/p/mcj/tickets/116/
Upstream fix:
https://sourceforge.net/p/mcj/fig2dev/ci/6827c09d2d6491cb2ae3ac7196439ff3aa791fd9/
Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via putpatternarc function.
heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via createlinewithspline.
Floating point exception in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via getslope function.
In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via readarcobject function.
In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via readobjects function.
A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via gengeitpspline function.
makearrow in arrow.c in Xfig fig2dev 3.2.7b allows a segmentation fault and out-of-bounds write because of an integer overflow via a large arrow type.
A global buffer overflow in the setcolor component in genge.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into ge format.
A global buffer overflow in the setfill component in genge.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into ge format.
A double-free vulnerability exists in fig2dev through 3.28a is affected by: via the freestream function in readpics.c, which could cause a denial of service (context-dependent).
A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the openstream function in readpics.c.
A stack-based buffer overflow in the genptktext component in genptk.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into ptk format.
A stack-based buffer overflow in the genpstrxtext() component in genpstricks.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into pstricks format.
A global buffer overflow in the genmpwritefontmacrolatex component in genmp.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into mp format.
A global buffer overflow in the putfont in genpict2e.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into pict2e format.
A global buffer overflow in the shadeortintnameafterdeclarecolor in genpstricks.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into pstricks format.
A stack-based buffer overflow in the putarrow() component in genpict2e.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into pict2e format.