xfig 3.2.7 is vulnerable to Buffer Overflow.

An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the readtextobject functions in read.c and read13.c.

readcolordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write.

readtextobject in read.c in Xfig fig2dev 3.2.7b has a stack-based buffer overflow because of an incorrect sscanf.

fig2dev 3.2.7b contains a global buffer overflow in the setfigfont function in genepic.c.

fig2dev 3.2.7b contains a segmentation fault in the readobjects function in read.c.

fig2dev 3.2.7b contains a segmentation fault in the gencgmstart function in gencgm.c.

fig2dev 3.2.7b contains a stack buffer overflow in the readtextobject function in read.c.

fig2dev 3.2.7b contains a global buffer overflow in the getline function in read.c.

fig2dev 3.2.7b contains a stack buffer overflow in the bezierspline function in genepic.c.

fig2dev 3.2.7b contains a global buffer overflow in the convpatternindex function in gencgm.c.

An issue was discovered in fig2dev before 3.2.8.. A NULL pointer dereference exists in the function computeclosedspline() located in transspline.c. It allows an attacker to cause Denial of Service. The fixed version of fig2dev is 3.2.8.

Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the calcarrow function in bound.c.

Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server or window manager.