A stack-based buffer overflow in the put_arrow() component in genpict2e.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into pict2e format.
The stack buffer overflow affects all RHEL Versions and is due to how arrow heads with lengths of zero are drawn. They were originally drawn secant to the arc. This was detected but caused the program to return in an improper way with an invalid value set. The invalid value allowed for illegal access of an array which in turn led to the stack buffer overflow. This is fixed in the following patch: https://sourceforge.net/p/mcj/fig2dev/ci/100e2789f8106f9cc0f7e4319c4ee7bda076c3ac/