Arbitrary Code Execution

transfig is vulnerable to arbitrary code execution. A buffer underwrite vulnerability in getline in read.c allows an attacker to write prior to the beginning of the buffer via a malicious .fig file, potentially obtaining arbitrary code execution on the host OS...

SUSE SLES12 Security Update : transfig (SUSE-SU-2020:1806-1)

This update for transfig fixes the following issues : Security issue fixed : CVE-2019-14275: Fixed stack-based buffer overflow in the calcarrow function bsc1143650. CVE-2018-16140: Fixed a buffer underwrite vulnerability in getline in read.c, which allowed an attacker to write prior to the...

SUSE-SU-2020:1806-1 Security update for transfig

This update for transfig fixes the following issues: Security issue fixed: - CVE-2019-14275: Fixed stack-based buffer overflow in the calcarrow function bsc1143650. - CVE-2018-16140: Fixed a buffer underwrite vulnerability in getline in read.c, which allowed an attacker to write prior to the...

Updated transfig packages fix security vulnerability

The updated package fixes security vulnerabilities: Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the calcarrow function in bound.c. CVE-2019-14275 readtextobject in read.c in Xfig fig2dev 3.2.7b has a stack-based buffer overflow because of an incorrect sscanf. CVE-2019-19555 makearrow...

Amazon Linux 2 : transfig (ALAS-2020-1398)

The version of transfig installed on the remote host is prior to 3.2.7b-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1398 advisory. readcolordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write. CVE-2019-19797 makearrow in arrow.c in Xfig...

Medium: transfig

Issue Overview: readcolordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write. CVE-2019-19797 makearrow in arrow.c in Xfig fig2dev 3.2.7b allows a segmentation fault and out-of-bounds write because of an integer overflow via a large arrow type. CVE-2019-19746 Affected Packages: transfi...

Fedora: Security Advisory for transfig (FEDORA-2020-5d0f0593ae)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for transfig (FEDORA-2020-6a2824178e)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 31 : 1:transfig / xfig (2020-5d0f0593ae)

Security fix for CVE-2019-19746, CVE-2019-19797 - New upstream release 3.2.7b - Add patch fixing CVE-2019-19746 rhbz1787040 - Add patch fixing CVE-2019-19797 rhbz1786726 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

Fedora 30 : 1:transfig / xfig (2020-6a2824178e)

Security fix for CVE-2019-19746, CVE-2019-19797 - New upstream release 3.2.7b - Add patch fixing CVE-2019-19746 rhbz1787040 - Add patch fixing CVE-2019-19797 rhbz1786726 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

[SECURITY] Fedora 31 Update: transfig-3.2.7b-1.fc31

The transfig utility creates a makefile which translates FIG created by xfig or PIC figures into a specified LaTeX graphics language for example, PostScriptTM. Transfig is used to create TeX documents which are portable i.e., they can be printed in a wide variety of environments. Install transfig...

[SECURITY] Fedora 30 Update: transfig-3.2.7b-1.fc30

The transfig utility creates a makefile which translates FIG created by xfig or PIC figures into a specified LaTeX graphics language for example, PostScriptTM. Transfig is used to create TeX documents which are portable i.e., they can be printed in a wide variety of environments. Install transfig...

Debian: Security Advisory (DLA-2073-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2073-1 : transfig security update

Several issues have been found in transfig, a XFig figure files converter. CVE-2018-16140 Buffer underwrite vulnerability in getline allows an attacker to write prior to the beginning of the buffer via a crafted .fig file. CVE-2019-14275 Stack-based buffer overflow in the calcarrow function in...

[SECURITY] [DLA 2073-1] transfig security update

Package : transfig Version : 1:3.2.5.e-4+deb8u2 CVE ID : CVE-2018-16140 CVE-2019-14275 CVE-2019-19555 Several issues have been found in transfig, a XFig figure files converter. CVE-2018-16140 Buffer underwrite vulnerability in getline allows an attacker to write prior to the beginning of the buff...

DLA-2073-1 transfig - security update

Bulletin has no description...

openSUSE Security Update : transfig (openSUSE-2019-1455)

This update for transfig fixes the following issues : Security issue fixed : - CVE-2018-16140: Fixed a buffer underwrite vulnerability in getline in read.c, which allowed an attacker to write prior to the beginning of the buffer via specially crafted .fig file bsc1106531 This update was imported...

openSUSE: Security Advisory for transfig (openSUSE-SU-2019:1455-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2019:1455-1 Security update for transfig

This update for transfig fixes the following issues: Security issue fixed: - CVE-2018-16140: Fixed a buffer underwrite vulnerability in getline in read.c, which allowed an attacker to write prior to the beginning of the buffer via specially crafted .fig file bsc1106531 This update was imported fr...

Security update for transfig (low)

openSUSE Security Update: Security update for transfig Announcement ID: openSUSE-SU-2019:1455-1 Rating: low References: 1106531 Cross-References: CVE-2018-16140 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This upda...