See how xfig compares to other vendors in security performance
A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezierspline function.
PEDAMACHEPHEPTOLIONES and D.B. COOPER found a stack-based buffer overflow, present in Xfig, Transfig by loading malformed .FIG files. A remote attacker could provide a specially-crafted .FIG text object file, which once opened by a local, unsuspecting user would lead to denial of service (Xfig, fig2dev crash).
References: ----------- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559274
Fortran PoC by PEDAMACHEPHEPTOLIONES: ------------------------------------- http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=xfigpoc.f;att=1;bug=559274
CVE was requested here: ----------------------- http://www.openwall.com/lists/oss-security/2009/12/03/2
A stack-based buffer overflow flaw was found in the way Xfig processed certain FIG images. A remote attacker could create a FIG image with specially-crafted color definition, and trick the local, unsuspecting user into opening it, which could lead to xfig executable crash or, potentially, arbitrary code execution with the privileges of the user running the executable.
References: [1] https://bugzilla.redhat.com/showbug.cgi?id=657981
Public PoC: [2] https://bugzilla.redhat.com/attachment.cgi?id=463393
Flaw severity note: On systems with compile time buffer checks (FORTIFYSOURCE) feature enabled, the impact of this flaw is mitigated to be only crash.
In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via readarcobject function.
In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via readobjects function.
A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via gengeitpspline function.
Xfig, possibly 3.2.5, allows local users to read and write arbitrary files via a symlink attack on the (1) xfig-eps[PID], (2) xfig-pic[PID].pix, (3) xfig-pic[PID].err, (4) xfig-pcx[PID].pix, (5) xfig-xfigrc[PID], (6) xfig[PID], (7) xfig-print[PID], (8) xfig-export[PID].err, (9) xfig-batch[PID], (10) xfig-exp[PID], or (11) xfig-spell.[PID] temporary files, where [PID] is a process ID.
Stack consumption vulnerability in ubound.c in Xfig 3.2.5b and earlier allows remote attackers to cause a denial of service (application crash) via a long string in a malformed .fig file that uses the 1.3 file format, possibly related to the readfpfig function in fread.c.
Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server or window manager.
PEDAMACHEPHEPTOLIONES and D.B. COOPER found a stack-based buffer overflow, present in Xfig, Transfig by loading malformed .FIG files. A remote attacker could provide a specially-crafted .FIG text object file, which once opened by a local, unsuspecting user would lead to denial of service (Xfig, fig2dev crash).
References: ----------- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559274
Fortran PoC by PEDAMACHEPHEPTOLIONES: ------------------------------------- http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=xfigpoc.f;att=1;bug=559274
CVE was requested here: ----------------------- http://www.openwall.com/lists/oss-security/2009/12/03/2
A stack-based buffer overflow flaw was found in the way Xfig processed certain FIG images. A remote attacker could create a FIG image with specially-crafted color definition, and trick the local, unsuspecting user into opening it, which could lead to xfig executable crash or, potentially, arbitrary code execution with the privileges of the user running the executable.
References: [1] https://bugzilla.redhat.com/showbug.cgi?id=657981
Public PoC: [2] https://bugzilla.redhat.com/attachment.cgi?id=463393
Flaw severity note: On systems with compile time buffer checks (FORTIFYSOURCE) feature enabled, the impact of this flaw is mitigated to be only crash.