Bug 1992788 (CVE-2020-21681)

Summary:	CVE-2020-21681 transfig: A global buffer overflow in the set_color component in genge.c could result in a denial of service
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	databases-maint, hhorak, kasal, mschorm, panovotn, pkubat
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	1998349, 1998350
Bug Blocks:	1992794

Description Michael Kaplan 2021-08-11 18:10:23 UTC

A global buffer overflow in the set_color component in genge.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into ge format.

Reference:

https://sourceforge.net/p/mcj/tickets/73/

Comment 1 Garrett Tucker 2021-08-26 21:37:25 UTC

A buffer overflow was possible when choosing the default color when converting to ge. The value associated with the default color enabled access of the array outside of the intended range and would result in a DoS. This has been remediated in: https://sourceforge.net/p/mcj/fig2dev/ci/4d4e1fdac467c386cba8706aa0067d5ab8da02d7/