Bug 2006516 (CVE-2021-32280) - CVE-2021-32280 transfig: NULL pointer dereference in compute_closed_spline() in trans_spline.c
Summary: CVE-2021-32280 transfig: NULL pointer dereference in compute_closed_spline() ...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2021-32280
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2006517 2006830 2006831
Blocks: 2006518
TreeView+ depends on / blocked
 
Reported: 2021-09-21 18:42 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-12-13 13:39 UTC (History)
6 users (show)

Fixed In Version: transfig 3.2.8
Clone Of:
Environment:
Last Closed: 2023-12-13 13:39:49 UTC
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2021-09-21 18:42:47 UTC 
An issue was discovered in fig2dev through 20200520. A NULL pointer dereference exists in the function compute_closed_spline() located in trans_spline.c. It allows an attacker to cause Denial of Service.

Reference:
https://sourceforge.net/p/mcj/tickets/107/
Comment 1 Guilherme de Almeida Suckevicz 2021-09-21 18:43:00 UTC 
Created transfig tracking bugs for this issue:

Affects: fedora-all [bug 2006517]
Comment 3 devthomp 2021-09-22 13:49:09 UTC 
patch:
https://sourceforge.net/p/mcj/fig2dev/ci/f17a3b8a7d54c1bc56ab92512531772a0b3ec991/
Note You need to log in before you can comment on or make changes to this bug.