Lucene search

K
mageiaGentoo FoundationMGASA-2023-0101
HistoryMar 19, 2023 - 1:16 a.m.

Updated xfig packages fix security vulnerability

2023-03-1901:16:28
Gentoo Foundation
advisories.mageia.org
9
buffer overflow
security vulnerability
xfig package
arbitrary code
denial-of-service
cve-2021-40241
unix

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

55.3%

A potential buffer overflow exists in the file src/w_help.c at line 55. Specifically, the length of the string returned by getenv(“LANG”) may become very long and cause a buffer overflow while executing the sprintf() function. This vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition. (CVE-2021-40241)

OSVersionArchitecturePackageVersionFilename
Mageia8noarchxfig< 3.2.7b-1.1xfig-3.2.7b-1.1.mga8

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

55.3%