Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 8 Dec 2009 12:43:45 -0500 (EST)
From: "Steven M. Christey" <>
To: oss-security <>,
        oss-security <>
cc: "Steven M. Christey" <>
Subject: Re: CVE Request -- xfig

On Thu, 3 Dec 2009, Jan Lieskovsky wrote:

>  PEDAMACHEPHEPTOLIONES reported [1] a stack-based buffer overflow present
> in Xfig by loading malformed .FIG files.

Use CVE-2009-4227 for the read_1_3_textobject

I also assigned CVE-2009-4228 for a stack-consumption issue (NOT an 
overflow) in u_bound.c, associated with the readfp_fig function in 

- Steve

Name: CVE-2009-4227
Status: Candidate
Reference: MLIST:[oss-security] 20091203 CVE Request -- xfig
Reference: URL:
Reference: CONFIRM:
Reference: CONFIRM:
Reference: BID:37193
Reference: URL:
Reference: SECUNIA:37571
Reference: URL:
Reference: SECUNIA:37577
Reference: URL:
Reference: XF:xfig-read13textobject-bo(54525)
Reference: URL:

Stack-based buffer overflow in the read_1_3_textobject function in
f_readold.c in Xfig 3.2.5b and earlier, and in the read_textobject
function in read1_3.c in fig2dev in Transfig 3.2.5a and earlier,
allows remote attackers to execute arbitrary code via a long string in
a malformed .fig file that uses the 1.3 file format.  NOTE: some of
these details are obtained from third party information.

Name: CVE-2009-4228
Status: Candidate
Reference: CONFIRM:
Reference: CONFIRM:

Stack consumption vulnerability in u_bound.c in Xfig 3.2.5b and
earlier allows remote attackers to cause a denial of service
(application crash) via a long string in a malformed .fig file that
uses the 1.3 file format, possibly related to the readfp_fig function
in f_read.c.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.