In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via readarcobject function.

A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via gengeitpspline function.

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via readobjects function.

A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezierspline function.

Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server or window manager.

A stack-based buffer overflow flaw was found in the way Xfig processed certain FIG images. A remote attacker could create a FIG image with specially-crafted color definition, and trick the local, unsuspecting user into opening it, which could lead to xfig executable crash or, potentially, arbitrary code execution with the privileges of the user running the executable.

References: [1] https://bugzilla.redhat.com/showbug.cgi?id=657981

Public PoC: [2] https://bugzilla.redhat.com/attachment.cgi?id=463393

Flaw severity note: On systems with compile time buffer checks (FORTIFYSOURCE) feature enabled, the impact of this flaw is mitigated to be only crash.

A stack-based buffer overflow flaw was found in the way Xfig processed certain FIG images. A remote attacker could create a FIG image with specially-crafted color definition, and trick the local, unsuspecting user into opening it, which could lead to xfig executable crash or, potentially, arbitrary code execution with the privileges of the user running the executable.

References: [1] https://bugzilla.redhat.com/showbug.cgi?id=657981

Public PoC: [2] https://bugzilla.redhat.com/attachment.cgi?id=463393

Flaw severity note: On systems with compile time buffer checks (FORTIFYSOURCE) feature enabled, the impact of this flaw is mitigated to be only crash.

PEDAMACHEPHEPTOLIONES and D.B. COOPER found a stack-based buffer overflow, present in Xfig, Transfig by loading malformed .FIG files. A remote attacker could provide a specially-crafted .FIG text object file, which once opened by a local, unsuspecting user would lead to denial of service (Xfig, fig2dev crash).

References: ----------- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559274

Fortran PoC by PEDAMACHEPHEPTOLIONES: ------------------------------------- http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=xfigpoc.f;att=1;bug=559274

CVE was requested here: ----------------------- http://www.openwall.com/lists/oss-security/2009/12/03/2

Stack consumption vulnerability in ubound.c in Xfig 3.2.5b and earlier allows remote attackers to cause a denial of service (application crash) via a long string in a malformed .fig file that uses the 1.3 file format, possibly related to the readfpfig function in fread.c.

PEDAMACHEPHEPTOLIONES and D.B. COOPER found a stack-based buffer overflow, present in Xfig, Transfig by loading malformed .FIG files. A remote attacker could provide a specially-crafted .FIG text object file, which once opened by a local, unsuspecting user would lead to denial of service (Xfig, fig2dev crash).

References: ----------- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559274

Fortran PoC by PEDAMACHEPHEPTOLIONES: ------------------------------------- http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=xfigpoc.f;att=1;bug=559274

CVE was requested here: ----------------------- http://www.openwall.com/lists/oss-security/2009/12/03/2

Xfig, possibly 3.2.5, allows local users to read and write arbitrary files via a symlink attack on the (1) xfig-eps[PID], (2) xfig-pic[PID].pix, (3) xfig-pic[PID].err, (4) xfig-pcx[PID].pix, (5) xfig-xfigrc[PID], (6) xfig[PID], (7) xfig-print[PID], (8) xfig-export[PID].err, (9) xfig-batch[PID], (10) xfig-exp[PID], or (11) xfig-spell.[PID] temporary files, where [PID] is a process ID.