Bug 1992788 (CVE-2020-21681)

Summary: CVE-2020-21681 transfig: A global buffer overflow in the set_color component in genge.c could result in a denial of service
Product: [Other] Security Response Reporter: Michael Kaplan <mkaplan>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: databases-maint, hhorak, kasal, mschorm, panovotn, pkubat
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1998349, 1998350    
Bug Blocks: 1992794    

Description Michael Kaplan 2021-08-11 18:10:23 UTC
A global buffer overflow in the set_color component in genge.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into ge format.



Comment 1 Garrett Tucker 2021-08-26 21:37:25 UTC
A buffer overflow was possible when choosing the default color when converting to ge. The value associated with the default color enabled access of the array outside of the intended range and would result in a DoS. This has been remediated in: https://sourceforge.net/p/mcj/fig2dev/ci/4d4e1fdac467c386cba8706aa0067d5ab8da02d7/